32 bit unsigned overflow in dcmjpeg/libsrc/djcodecd.cc

[Shaeto]

dcmtk 3.6.7/3.6.8

file dcmjpeg/libsrc/djcodecd.cc

line 169:

result = uncompressedPixelData.createUint16Array(OFstatic_cast(Uint32, totalSize / sizeof(Uint16)), imageData16);
if (result.good())
{
....
}

in my example i have dicom containing 9825 8bit jpeg frames 1024x1024 frameSize=1048576
totalSize=10302259200, static cast produces value 856162304, so, result of createUint16Array is good() but decoder fails (of course) in line 190: jpeg->decode(..)

i _understand_ that this dicom can't be represented as an uncompressed little endian explicit but decoder shouldn't produce sigsegv anyway and return something like EC_MemoryExhausted

[J. Riesmeier]

Thank you for your report. In fact, this issue has been fixed only recently (i.e. after the release of DCMTK 3.6.8 ). See this commit: https://git.dcmtk.org/?p=dcmtk.git;a=co ... 4a6cce06dd

[Shaeto]

Thank you! will try to cherry-pick this fix to 3.6.8