Actions
Bug #1211
closed
Heap-buffer-overflow in I2DBmpSource::parse24_32BppRow()
Start date:
2026-05-21
Due date:
% Done:
100%
Estimated time:
1:00 h
Module:
dcmdata
Operating System:
Compiler:
Description
An invalid BMP file with 16, 24 or 32 bit per pixel that contains a color palette (which is not permitted for these images) consisting only of gray values causes a buffer overflow in I2DBmpSource::parse24_32BppRow(). The code only allocated enough memory for a monochrome image, but then writes an RGB bitmap into that buffer.
The issue can be reproduced by compiling DCMTK with -fsanitize=address,undefined and then calling
img2dcm -i BMP oob-i2dbmps-parse24bpp.bmp out.dcm
Reported 2026-05-04 by Kaixuan.
Files
Updated by Marco Eichelberg 5 days ago
- Status changed from New to Closed
- % Done changed from 0 to 100
- Estimated time set to 1:00 h
Closed by commit #68b57d3cf.
Actions