Bug #797
closed
DcmPixelItem::createOffsetTable() does not check for 32-bit integer overflows (and other issues)
100%
Description
The implementation of DcmPixelItem::createOffsetTable() adds the size of the individual frames specified by the given "offsetList". However, it does not check whether there is an 32-bit integer overflow (Uint32), which could happen since the number of pixel items (frames) in the pixel sequence is not limited (when using undefined length encoding).
Also, the name of the parameter "offsetList" is misleading since it does not store the offsets (start of each frame) but their sizes. In fact, the description "list of size entries for each individual encoded frame provided by the compression codec" is misleading in another aspect: the entries do not store the size of "each individual encoded frame" but the size of the pixel items (which includes the so-called item header = 8 bytes). Documentation and parameter naming should be improved.
Updated by Jörg Riesmeier almost 8 years ago
- Description updated (diff)
- Status changed from New to Closed
- Assignee set to Jörg Riesmeier
- % Done changed from 0 to 100
Fixed by commit 1a777f3 and 250cf6f.