From f6a092f21d33631e3b1e1f614298ee4aa5fdd868 Mon Sep 17 00:00:00 2001 From: Debian Med Packaging Team Date: Fri, 21 Mar 2025 12:45:44 +0100 Subject: [PATCH] CVE-2025-25475 commit bffa3e9116abb7038b432443f16b1bd390e80245 Author: Marco Eichelberg Date: Thu Jan 23 15:51:21 2025 +0100 Fixed issue with invalid RLE compressed DICOM images. Fixed issue when processing an RLE compressed image where the RLE header contains an invalid stripe size. Thanks to Ding zhengzheng for the report and the sample file (PoC). Gbp-Pq: Name 0009-CVE-2025-25475.patch --- dcmdata/libsrc/dcrleccd.cc | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/dcmdata/libsrc/dcrleccd.cc b/dcmdata/libsrc/dcrleccd.cc index fd01b63b..e45ef0c1 100644 --- a/dcmdata/libsrc/dcrleccd.cc +++ b/dcmdata/libsrc/dcrleccd.cc @@ -1,6 +1,6 @@ /* * - * Copyright (C) 2002-2024, OFFIS e.V. + * Copyright (C) 2002-2025, OFFIS e.V. * All rights reserved. See COPYRIGHT file for details. * * This software and supporting documentation were developed by @@ -348,6 +348,12 @@ OFCondition DcmRLECodecDecoder::decode( } /* while */ // last fragment for this RLE stripe + if (inputBytes + byteOffset > fragmentLength) + { + DCMDATA_ERROR("stream size in RLE header is wrong"); + inputBytes = fragmentLength-byteOffset; + } + result = rledecoder.decompress(rleData + byteOffset, OFstatic_cast(size_t, inputBytes)); // special handling for zero pad byte at the end of the RLE stream -- 2.30.2