DCMTK

In 2014, our team discovered an overflow bug in the CharLS encoder and submitted a patch [[http://charls.codeplex.com/workitem/10742]] that was also included in DCMJPLS (dcmjpls/libcharls/encodstr.h). However, according to Mathieu Malaterre, the patch does not solve all cases, and needs further modification as follows:

--- a/dcmjpls/libcharls/encodstr.h
+++ b/dcmjpls/libcharls/encodstr.h
@@ -70,17 +70,23 @@ protected:
 #endif

      bitpos -= length;
-     if (bitpos > 0)
+     if (bitpos >= 0)
      {
              valcurrent = valcurrent | (value << bitpos);
              return;
      }
+
      valcurrent |= value >> -bitpos;
+     Flush();

+     // A second flush may be required if extra marker-detect bits were needed and not all bits could be written.
+     if (bitpos < 0)
+     {
+           valcurrent |= value >> -bitpos;
            Flush();
+     }

      ASSERT(bitpos >=0);
-     if (bitpos < 32)
      valcurrent |= value << bitpos;
   }

@@ -107,7 +113,7 @@ protected:

       if (_isFFWritten)
       {
-        // insert highmost bit
+        // JPEG-LS requirement (T.87, A.1) to detect markers: after a xFF value a single 0 bit needs to be inserted.
         *_position = BYTE(valcurrent >> 25);
         valcurrent = valcurrent << 7;
         bitpos += 7;

The patch compiles in DCMTK, but needs some testing before being committed.