Project

General

Profile

Bug #1190

Updated by Jörg Riesmeier 4 days ago

Received by email from the IN-CYPHER OSS Security Team IG Singapore (2026-03-09): 

 > *Subject:* IC-DCMTK-0004 Infinite Loop in JPEG Segment Parser TEM Marker 
 >  
 > This report describes a infinite loop in 
 > DJCodecDecoder::scanJpegDataForBitDepth() at djcodecd.cc:852. The 
 > function's JPEG marker parsing loop handles over 30 marker types, with 
 > each case advancing the parsing offset -- except the TEM marker 
 > (0xFF01), whose case contains only a break without incrementing the 
 > offset. This causes the parser to re-read the same TEM marker 
 > indefinitely, consuming 100% CPU with no timeout or iteration limit. A 
 > 526-byte DICOM file with a JPEG stream containing a TEM marker triggers 
 > this hang. The fix is a single line: adding offset += 2; before the 
 > break. 
 >  
 > Please find the detailed report, proof-of-concept, and sanitizer output 
 > in the attachments.

Back