DCMTK

The sendDcmDataset() function in the dcmnet module can get into an infinite loop when trying to send a dataset in Deflated transfer syntax.

This happens when the input buffer of the compressed stream filter has only 2, 4 or 6 bytes left, and DcmSequence::write() or DcmItem::write() return EC_StreamNotifyClient because the tag and length for the sequence or item tag do not fit into the buffer. In this case, DcmOutputStream::write() is never called, so the compression filter will never compress and clean the input buffer, the output buffer remains empty and repeated calls to DcmDataset::write() always return EC_StreamNotifyClient, causing an infinite loop.

The bug can be demonstrated by starting storescp with

storescp 11112 --prefer-deflated

and then running storescu with the attached sample file:

storescu --propose-deflated localhost 11112 EndlessLoopAnonymized.dcm

This issue probably affects all DCMTK releases that support network transmissions in Deflated transfer syntax, i.e. 3.5.2 to 3.6.7.