# Buffer overflow in getting properties

**URL:** <https://discourse.itk.org/t/buffer-overflow-in-getting-properties/2363>\
**Category:** Algorithms\
**Tags:** dicom, simpleitk, python\
**Created:** [October 29, 2019, 6:23pm UTC](https://discourse.itk.org/t/buffer-overflow-in-getting-properties/2363 "2019-10-29T18:23:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![msh\_smlv](https://discourse.itk.org/user_avatar/discourse.itk.org/msh_smlv/32/1036_2.png) [@msh\_smlv](https://discourse.itk.org/u/msh_smlv)\
**Post date:** [October 29, 2019, 6:23pm UTC](https://discourse.itk.org/t/buffer-overflow-in-getting-properties/2363/1 "2019-10-29T18:23:58Z")

</div>

Hello!

During an internal security assessment of the medical ML pipeline based on Simple-itk we found buffer-overflow in DicomReader.

I guess that it happens because you use the buffer which is located on the stack for getting properties.  
In the attached file you can find the file which triggers the buffer-overflow(With long PatientName, the length more than 512) and the source code which we used.

We also tried to read this file with python module The behavior was the same.

 ![29](https://discourse.itk.org/uploads/default/original/2X/9/94c327d3759f9733d1fd00bd3fb85fb8746a7f2c.png)  
[buffer\_overflow.zip](https://discourse.itk.org/uploads/short-url/sg0XawvsZ2j3gkm6KupWtDNS4lm.zip) (270.5 KB) .

Thanks.

---

<div class="post-metadata">

**Author:** ![blowekamp](https://discourse.itk.org/user_avatar/discourse.itk.org/blowekamp/32/79_2.png) [@blowekamp](https://discourse.itk.org/u/blowekamp)\
**Post date:** [October 29, 2019, 6:36pm UTC](https://discourse.itk.org/t/buffer-overflow-in-getting-properties/2363/2 "2019-10-29T18:36:20Z")

</div>

Thank you for reporting the issue. And tracking it down. Could you please create an issue on Github:

> **[InsightSoftwareConsortium/ITK](https://github.com/InsightSoftwareConsortium/ITK/issues)**
>
> Insight Toolkit (ITK) -- Official Repository. Contribute to InsightSoftwareConsortium/ITK development by creating an account on GitHub.

---

<div class="post-metadata">

**Author:** ![blowekamp](https://discourse.itk.org/user_avatar/discourse.itk.org/blowekamp/32/79_2.png) [@blowekamp](https://discourse.itk.org/u/blowekamp)\
**Post date:** [October 30, 2019, 11:32am UTC](https://discourse.itk.org/t/buffer-overflow-in-getting-properties/2363/3 "2019-10-30T11:32:52Z")

</div>

This issue is addressed in this PR: [https://github.com/InsightSoftwareConsortium/ITK/pull/1373](https://github.com/InsightSoftwareConsortium/ITK/pull/1373)