Skip to content

Fix memory-safety bugs in DVPSIPCMessage network parsing #152

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
JeroenRobben wants to merge 2 commits into from
Closed

Fix memory-safety bugs in DVPSIPCMessage network parsing #152

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c717c1c
Fix heap buffer overflow due to unvalidated payload length in DVPSIPC…
JeroenRobben Jul 13, 2026
7e29a7c
Fix out-of-bounds read on non-terminated IPC string payload
JeroenRobben Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 14 additions & 2 deletions dcmpstat/libsrc/dvpsmsg.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@

#define PAYLOAD_ALLOCATION_UNIT 1024
#define PAYLOAD_OFFSET 8
#define PAYLOAD_MAX_SIZE (64 * 1024)

// constants for message type
const Uint32 DVPSIPCMessage::OK = 0;
Expand Down Expand Up @@ -162,7 +163,11 @@ OFBool DVPSIPCMessage::extractStringFromPayload(OFString& str)
// check if we have sufficient data available
if (payloadReadOffset + length > payloadUsed) return OFFalse;

str = (const char *)(payload+payloadReadOffset); // guaranteed to be zero terminated string
// do not assume the payload is zero terminated: scan at most 'length' bytes
const char *strStart = (const char *)(payload+payloadReadOffset);
Uint32 strLen = 0;
while (strLen < length && strStart[strLen] != '\0') ++strLen;
str.assign(strStart, strLen);
payloadReadOffset += length;
return OFTrue;
}
Expand Down Expand Up @@ -215,12 +220,19 @@ OFBool DVPSIPCMessage::receive(DcmTransportConnection &connection)
messageType = *(Uint32 *)payload;
payloadUsed = *(Uint32 *)(payload+sizeof(Uint32));

// reject implausibly large payloads read from the network
if (payloadUsed > PAYLOAD_MAX_SIZE)
{
payloadUsed = PAYLOAD_OFFSET;
return OFFalse;
}

// check if we need to allocate more memory
Uint32 requiredSize = payloadUsed + PAYLOAD_OFFSET;
if (requiredSize > payloadAllocated)
{
delete[] payload;
while (payloadAllocated < requiredSize) payloadAllocated += PAYLOAD_ALLOCATION_UNIT;
delete[] payload;
payload = new unsigned char[payloadAllocated];
}

Expand Down
Loading