CVE-2025-14841

commit ffb1a4a37d2c876e3feeb31df4930f2aed7fa030
Author: Marco Eichelberg <eichelberg@offis.de>
Date:   Fri Nov 28 12:24:07 2025 +0100

    Fixed two possible segfaults in dcmqrscp.

    Fixed two places where invalid messages may trigger a segmentation fault
    due to a NULL pointer being de-referenced.

    Thanks to 邹 迪凯 <zoudikai@outlook.com> for the bug report and proof-of-concept.

Gbp-Pq: Name 0017-CVE-2025-14841.patch

diff --git a/dcmqrdb/libsrc/dcmqrdbi.cc b/dcmqrdb/libsrc/dcmqrdbi.cc
index 132f8a115a5cd6d8ba4763581d15f1d032671f10..42467467f13654bd92810f4d2b3a7ed4d53760a6 100644 (file)
--- a/dcmqrdb/libsrc/dcmqrdbi.cc
+++ b/dcmqrdb/libsrc/dcmqrdbi.cc
@@ -1381,8 +1381,10 @@ OFCondition DcmQueryRetrieveIndexDatabaseHandle::startFindRequest(
                 /* only char string type tags are supported at the moment */
                 char *s = NULL;
                 dcelem->getString(s);
+
                 /* the available space is always elem.ValueLength+1 */
-                OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1);
+                if (s) OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1);
+                    else elem.PValueField[0]='\0';
             }
             /** If element is the Query Level, store it in handle
              */
@@ -2066,8 +2068,10 @@ OFCondition DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest(
                 /* only char string type tags are supported at the moment */
                 char *s = NULL;
                 dcelem->getString(s);
+
                 /* the available space is always elem.ValueLength+1 */
-                OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1);
+                if (s) OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1);
+                    else elem.PValueField[0]='\0';
             }
 
             /** If element is the Query Level, store it in handle