CVE-2024-34509: Insufficient Information (NVD-CWE-noinfo)
value: dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-05T20:15Z
Repository: https://github.com/DCMTK/dcmtk
Language: C++
Files changed: dcmdata/libsrc/dcelem.cc, dcmnet/libsrc/dimcmd.cc
Commit date: 2024-03-13 17:15:58 +0100
Commit message: Fixed two segmentation faults.

Fixed two segmentations faults that could occur while processing an
invalid incoming DIMSE message due to insufficient error handling
causing a de-referenced NULL pointer.

Thanks to Nils Bars <nils.bars@rub.de> for the bug report and sample files.

This closes DCMTK issue #1114.

Diff: diff --git a/dcmdata/libsrc/dcelem.cc b/dcmdata/libsrc/dcelem.cc
index 1524904be9..3b9cc2bf7e 100644
--- a/dcmdata/libsrc/dcelem.cc
+++ b/dcmdata/libsrc/dcelem.cc
@@ -1,8 +1,8 @@
 /*
  *
- *  Copyright (C) 1994-2023, OFFIS e.V.
+ *  Copyright (C) 1994-2024, OFFIS e.V.
  *  All rights reserved.  See COPYRIGHT file for details.
  *
  *  This software and supporting documentation were developed by
  *
  *    OFFIS e.V.
@@ -715,10 +715,17 @@ OFCondition DcmElement::loadValue(DcmInputStream *inStream)
             /* if we created the stream from which information was read in this */
             /* function, we need to we need to delete this object here as well */
             if (isStreamNew)
                 delete readStream;
         }
+        else
+        {
+            errorFlag = EC_InvalidStream; // incomplete dataset read from stream
+            DCMDATA_ERROR("DcmElement: " << getTagName() << " " << getTag()
+                << " larger (" << getLengthField() << ") than remaining bytes ("
+                << getTransferredBytes() << ") in file, premature end of stream");
+        }
     }
     /* return result value */
     return errorFlag;
 }
 
diff --git a/dcmnet/libsrc/dimcmd.cc b/dcmnet/libsrc/dimcmd.cc
index 6dca39546d..ffd225f4b9 100644
--- a/dcmnet/libsrc/dimcmd.cc
+++ b/dcmnet/libsrc/dimcmd.cc
@@ -1,8 +1,8 @@
 /*
  *
- *  Copyright (C) 1994-2022, OFFIS e.V.
+ *  Copyright (C) 1994-2024, OFFIS e.V.
  *  All rights reserved.  See COPYRIGHT file for details.
  *
  *  This software and supporting documentation were partly developed by
  *
  *    OFFIS e.V.
@@ -203,26 +203,29 @@ getString(DcmDataset *obj, DcmTagKey t, char *s, int maxlen, OFBool *spacePadded
             s[0] = '\0';
         } else if (elem->getLength() > (Uint32)maxlen) {
             return parseErrorWithMsg("dimcmd:getString: string too small", t);
         } else {
             ec =  elem->getString(aString);
-            strncpy(s, aString, maxlen);
-            if (spacePadded)
+            if (ec.good())
             {
-                /* before we remove leading and tailing spaces we want to know
-                 * whether the string is actually space padded. Required to communicate
-                 * with dumb peers which send space padded UIDs and fail if they
-                 * receive correct UIDs back.
-                 *
-                 * This test can only detect space padded strings if
-                 * dcmEnableAutomaticInputDataCorrection is false; otherwise the padding
-                 * has already been removed by dcmdata at this stage.
-                 */
-                size_t s_len = strlen(s);
-                if ((s_len > 0)&&(s[s_len-1] == ' ')) *spacePadded = OFTrue; else *spacePadded = OFFalse;
+                strncpy(s, aString, maxlen);
+                if (spacePadded)
+                {
+                    /* before we remove leading and tailing spaces we want to know
+                     * whether the string is actually space padded. Required to communicate
+                     * with dumb peers which send space padded UIDs and fail if they
+                     * receive correct UIDs back.
+                     *
+                     * This test can only detect space padded strings if
+                     * dcmEnableAutomaticInputDataCorrection is false; otherwise the padding
+                     * has already been removed by dcmdata at this stage.
+                     */
+                    size_t s_len = strlen(s);
+                    if ((s_len > 0)&&(s[s_len-1] == ' ')) *spacePadded = OFTrue; else *spacePadded = OFFalse;
+                }
+                DU_stripLeadingAndTrailingSpaces(s);
             }
-            DU_stripLeadingAndTrailingSpaces(s);
         }
     }
     return (ec.good())? ec : DIMSE_PARSEFAILED;
 }
 

Vulnerable code:  *  Copyright (C) 1994-2023, OFFIS e.V.
 *  Copyright (C) 1994-2022, OFFIS e.V.
            strncpy(s, aString, maxlen);
            if (spacePadded)
                /* before we remove leading and tailing spaces we want to know
                 * whether the string is actually space padded. Required to communicate
                 * with dumb peers which send space padded UIDs and fail if they
                 * receive correct UIDs back.
                 *
                 * This test can only detect space padded strings if
                 * dcmEnableAutomaticInputDataCorrection is false; otherwise the padding
                 * has already been removed by dcmdata at this stage.
                 */
                size_t s_len = strlen(s);
                if ((s_len > 0)&&(s[s_len-1] == ' ')) *spacePadded = OFTrue; else *spacePadded = OFFalse;
            DU_stripLeadingAndTrailingSpaces(s);
Fixed code:  *  Copyright (C) 1994-2024, OFFIS e.V.
        else
        {
            errorFlag = EC_InvalidStream; // incomplete dataset read from stream
            DCMDATA_ERROR("DcmElement: " << getTagName() << " " << getTag()
                << " larger (" << getLengthField() << ") than remaining bytes ("
                << getTransferredBytes() << ") in file, premature end of stream");
        }
 *  Copyright (C) 1994-2024, OFFIS e.V.
            if (ec.good())
                strncpy(s, aString, maxlen);
                if (spacePadded)
                {
                    /* before we remove leading and tailing spaces we want to know
                     * whether the string is actually space padded. Required to communicate
                     * with dumb peers which send space padded UIDs and fail if they
                     * receive correct UIDs back.
                     *
                     * This test can only detect space padded strings if
                     * dcmEnableAutomaticInputDataCorrection is false; otherwise the padding
                     * has already been removed by dcmdata at this stage.
                     */
                    size_t s_len = strlen(s);
                    if ((s_len > 0)&&(s[s_len-1] == ' ')) *spacePadded = OFTrue; else *spacePadded = OFFalse;
                }
                DU_stripLeadingAndTrailingSpaces(s);