Fix CVE-2009-3994 (buffer overflow in GetUID() allows remote DOS or
arbitrary code execution via crafted DICOM file).

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3994

Copied from Fedora
https://pkgs.fedoraproject.org/cgit/rpms/DevIL.git/tree/DevIL-1.7.8-CVE-2009-3994.patch?id=9c656a75393d6c455aef9f4968fbbee9c53f4fdb

diff -up devil-1.7.8/src-IL/src/il_dicom.c~ devil-1.7.8/src-IL/src/il_dicom.c
--- devil-1.7.8/src-IL/src/il_dicom.c~	2009-03-08 08:10:09.000000000 +0100
+++ devil-1.7.8/src-IL/src/il_dicom.c	2009-12-03 12:07:45.000000000 +0100
@@ -427,9 +427,11 @@ ILboolean GetUID(ILubyte *UID)
 		return IL_FALSE;
 
 	ValLen = GetLittleUShort();
+	if (ValLen > 64)
+		return IL_FALSE;
 	if (iread(UID, ValLen, 1) != 1)
 		return IL_FALSE;
-	UID[64] = 0;  // Just to make sure that our string is terminated.
+	UID[ValLen] = 0;  // Just to make sure that our string is terminated.
 
 	return IL_TRUE;
 }
><td class='sub'>Wojtek's customized Guix</td><td class='sub right'></td></tr></table>
<table class='tabs'><tr><td>
<a href='/guix/about/'>about</a><a href='/guix/'>summary</a><a href='/guix/refs/?id=af943b8104357e38e5e3dcfd09bc884764b28deb'>refs</a><a class='active' href='/guix/log/gnu/packages/easyrpg.scm'>log</a><a href='/guix/tree/gnu/packages/easyrpg.scm?id=af943b8104357e38e5e3dcfd09bc884764b28deb'>tree</a><a href='/guix/commit/gnu/packages/easyrpg.scm?id=af943b8104357e38e5e3dcfd09bc884764b28deb'>commit</a><a href='/guix/diff/gnu/packages/easyrpg.scm?id=af943b8104357e38e5e3dcfd09bc884764b28deb'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/packages/easyrpg.scm'>
<input type='hidden' name='id' value='af943b8104357e38e5e3dcfd09bc884764b28deb'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=af943b8104357e38e5e3dcfd09bc884764b28deb'>root</a>/<a href='/guix/log/gnu?id=af943b8104357e38e5e3dcfd09bc884764b28deb'>gnu</a>/<a href='/guix/log/gnu/packages?id=af943b8104357e38e5e3dcfd09bc884764b28deb'>packages</a>/<a href='/guix/log/gnu/packages/easyrpg.scm?id=af943b8104357e38e5e3dcfd09bc884764b28deb'>easyrpg.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/packages/easyrpg.scm?id=af943b8104357e38e5e3dcfd09bc884764b28deb&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2022-01-18 01:14:15 +0100'>2022-01-18</span></td><td><a href='/guix/commit/gnu/packages/easyrpg.scm?id=b4dd92d38a966e14c338400b6b965bb31e4508de'>gnu: easyrpg-player: Update to 0.7.0.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/easyrpg.scm (easyrpg-player): Update to 0.7.0.
[inputs]: Add fluidsynth, fmt.
</span></span></td><td>Nicolas Goaziou</td></tr>
<tr><td><span title='2022-01-18 01:14:15 +0100'>2022-01-18</span></td><td><a href='/guix/commit/gnu/packages/easyrpg.scm?id=7c80c0dd082399830474b7d7fa2f1a829f5b5d91'>gnu: liblcf: Update to 0.7.0.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/easyrpg.scm (liblcf): Update to 0.7.0.
</span></span></td><td>Nicolas Goaziou</td></tr>
<tr><td><span title='2021-12-13 22:15:07 +0100'>2021-12-13</span></td><td><a href='/guix/commit/gnu/packages/easyrpg.scm?id=e3196755e60ba7f1ed9d432e73f26a85e0c8893c'>gnu: Further simplify package inputs.</a><span class='msg-avail'>...<span class='msg-tooltip'>This is the result of running:

  ./pre-inst-env guix style --input-simplification=safe

and manually undoing changes on a dozen of packages to reduce
rebuilds (derivations for emacs, icecat, and libreoffice are unchanged.)
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2021-12-13 17:48:25 +0100'>2021-12-13</span></td><td><a href='/guix/commit/gnu/packages/easyrpg.scm?id=8394619baceb118df92e355377fd543bb1aa501a'>gnu: Simplify package inputs.</a><span class='msg-avail'>...<span class='msg-tooltip'>This commit was obtained by running:

  ./pre-inst-env guix style

without any additional argument.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2021-09-18 23:16:22 +0200'>2021-09-18</span></td><td><a href='/guix/commit/gnu/packages/easyrpg.scm?id=4e44e1c67286d89728fc6eee650ddfecd6e35366'>gnu: easyrpg-player: Add wildmidi input.</a><span class='msg-avail'>...<span class='msg-tooltip'>Suggested by moshy on #guix.

* gnu/packages/easyrpg.scm (easyrpg-player)[inputs]: Add wildmidi.
</span></span></td><td>Tobias Geerinckx-Rice</td></tr>