0017-CVE-2025-14841.patch: new: fix CVE-2025-14841.

Closes: #1123584

diff --git a/debian/patches/0017-CVE-2025-14841.patch b/debian/patches/0017-CVE-2025-14841.patch
new file mode 100644 (file)
index 0000000..4f9caba
--- /dev/null
+++ b/debian/patches/0017-CVE-2025-14841.patch
@@ -0,0 +1,37 @@
+commit ffb1a4a37d2c876e3feeb31df4930f2aed7fa030
+Author: Marco Eichelberg <eichelberg@offis.de>
+Date:   Fri Nov 28 12:24:07 2025 +0100
+
+    Fixed two possible segfaults in dcmqrscp.
+    
+    Fixed two places where invalid messages may trigger a segmentation fault
+    due to a NULL pointer being de-referenced.
+    
+    Thanks to 邹 迪凯 <zoudikai@outlook.com> for the bug report and proof-of-concept.
+
+--- dcmtk.orig/dcmqrdb/libsrc/dcmqrdbi.cc
++++ dcmtk/dcmqrdb/libsrc/dcmqrdbi.cc
+@@ -1381,8 +1381,10 @@
+                 /* only char string type tags are supported at the moment */
+                 char *s = NULL;
+                 dcelem->getString(s);
++
+                 /* the available space is always elem.ValueLength+1 */
+-                OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1);
++                if (s) OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1);
++                    else elem.PValueField[0]='\0';
+             }
+             /** If element is the Query Level, store it in handle
+              */
+@@ -2066,8 +2068,10 @@
+                 /* only char string type tags are supported at the moment */
+                 char *s = NULL;
+                 dcelem->getString(s);
++
+                 /* the available space is always elem.ValueLength+1 */
+-                OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1);
++                if (s) OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1);
++                    else elem.PValueField[0]='\0';
+             }
+ 
+             /** If element is the Query Level, store it in handle

diff --git a/debian/patches/series b/debian/patches/series
index 0cad16a3744a2473f35a0778f3d2876e4535effb..8321f32989c518767eec70a7599433fec281564d 100644 (file)
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -12,3 +12,4 @@ remove_version.patch
 0014-CVE-2025-9732b.patch
 0015-CVE-2025-14607.patch
 0016-CVE-2026-5663.patch
+0017-CVE-2025-14841.patch