From 8e655b2056fd9b4c6ea09c1b072415b0d8a52931 Mon Sep 17 00:00:00 2001 From: Debian Med Packaging Team Date: Tue, 23 Jun 2026 21:44:21 +0200 Subject: [PATCH] CVE-2025-14607 commit 4c0e5c10079392c594d6a7abd95dd78ac0aa556a Author: Marco Eichelberg Date: Tue Dec 2 09:06:30 2025 +0100 Fixed bug in handling of odd-length data elements. When a dataset containing an illegal odd-length attribute with a text VR was read from file or received over a network connection, then accessing the value of that attribute with DcmElement::getString() may return a pointer to a string that was not properly null terminated. Using C string functions such as strlen() or strcpy() on that string then lead to a read beyond the end of a string, causing a segmentation fault. Thanks to Zou Dikai for the bug report and POC. This closes DCMTK issue #1184. Gbp-Pq: Name 0015-CVE-2025-14607.patch --- dcmdata/libsrc/dcbytstr.cc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/dcmdata/libsrc/dcbytstr.cc b/dcmdata/libsrc/dcbytstr.cc index ae4a9b63..adddbdb9 100644 --- a/dcmdata/libsrc/dcbytstr.cc +++ b/dcmdata/libsrc/dcbytstr.cc @@ -658,7 +658,11 @@ Uint8 *DcmByteString::newValueField() /* terminate string after real length */ if (value != NULL) + { value[lengthField] = 0; + value[lengthField+1] = 0; + } + /* enforce old (pre DCMTK 3.5.2) behaviour? */ if (!dcmAcceptOddAttributeLength.get()) { -- 2.30.2