DcmOtherByteOtherWord::createUint16Array() causes segfault

[mespak]

DcmOtherByteOtherWord::createUint16Array can cause segfault if the VR of the current tag is EVR_ox.

A sample code that can trigger the crash:

Code: Select all

  DcmOtherByteOtherWord* pixelData = new DcmOtherByteOtherWord(DCM_PixelData);
  uint16_t* p;
  pixelData->createUint16Array(sliceSize, p);

The last line should initialise the pointer but it does not. If you try to store any pixel value in the buffer, your app will crash. (The function returns EC_CorruptedData status, so you can at least check that.)

The fix is below.

Code: Select all

diff -urEb dcmtk-3.6.3/dcmdata/libsrc/dcvrobow.cc dcmtk-3.6.3-patched/dcmdata/libsrc/dcvrobow.cc
--- dcmtk-3.6.3/dcmdata/libsrc/dcvrobow.cc	2018-02-05 17:58:12.000000000 +0000
+++ dcmtk-3.6.3-patched/dcmdata/libsrc/dcvrobow.cc	2018-09-12 09:42:34.810468538 +0100
@@ -379,7 +379,8 @@
                                                      Uint16 *&words)
 {
     /* check value representation */
-    if ((getTag().getEVR() == EVR_OW) || (getTag().getEVR() == EVR_lt))
+    if ((getTag().getEVR() == EVR_OW) || (getTag().getEVR() == EVR_lt)
+        || (getTag().getEVR() == EVR_ox))
         errorFlag = createEmptyValue(OFstatic_cast(Uint32, sizeof(Uint16) * OFstatic_cast(size_t, numWords)));
     else
         errorFlag = EC_CorruptedData;

Note that DcmOtherByteOtherWord::createUint8Array would probably require a similar fix.

[J. Riesmeier]

DcmOtherByteOtherWord::createUint16Array can cause segfault if the VR of the current tag is EVR_ox.

Does it really cause a segfault? I mean you should always check the return value of a method that you've called (i.e. the status).

For the Pixel Data element you should rather use the DcmPixelData class with its createUint8/16Array() methods.