Fix CVE-2009-3994 (buffer overflow in GetUID() allows remote DOS or
arbitrary code execution via crafted DICOM file).

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3994

Copied from Fedora
https://pkgs.fedoraproject.org/cgit/rpms/DevIL.git/tree/DevIL-1.7.8-CVE-2009-3994.patch?id=9c656a75393d6c455aef9f4968fbbee9c53f4fdb

diff -up devil-1.7.8/src-IL/src/il_dicom.c~ devil-1.7.8/src-IL/src/il_dicom.c
--- devil-1.7.8/src-IL/src/il_dicom.c~	2009-03-08 08:10:09.000000000 +0100
+++ devil-1.7.8/src-IL/src/il_dicom.c	2009-12-03 12:07:45.000000000 +0100
@@ -427,9 +427,11 @@ ILboolean GetUID(ILubyte *UID)
 		return IL_FALSE;
 
 	ValLen = GetLittleUShort();
+	if (ValLen > 64)
+		return IL_FALSE;
 	if (iread(UID, ValLen, 1) != 1)
 		return IL_FALSE;
-	UID[64] = 0;  // Just to make sure that our string is terminated.
+	UID[ValLen] = 0;  // Just to make sure that our string is terminated.
 
 	return IL_TRUE;
 }
omized Guix</td><td class='sub right'></td></tr></table>
<table class='tabs'><tr><td>
<a href='/guix/about/'>about</a><a href='/guix/'>summary</a><a href='/guix/refs/?id=7136ea976f64aa10e93a61dd3215b4b5da1e6a9a'>refs</a><a class='active' href='/guix/log/nix/boost'>log</a><a href='/guix/tree/nix/boost?id=7136ea976f64aa10e93a61dd3215b4b5da1e6a9a'>tree</a><a href='/guix/commit/nix/boost?id=7136ea976f64aa10e93a61dd3215b4b5da1e6a9a'>commit</a><a href='/guix/diff/nix/boost?id=7136ea976f64aa10e93a61dd3215b4b5da1e6a9a'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/nix/boost'>
<input type='hidden' name='id' value='7136ea976f64aa10e93a61dd3215b4b5da1e6a9a'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=7136ea976f64aa10e93a61dd3215b4b5da1e6a9a'>root</a>/<a href='/guix/log/nix?id=7136ea976f64aa10e93a61dd3215b4b5da1e6a9a'>nix</a>/<a href='/guix/log/nix/boost?id=7136ea976f64aa10e93a61dd3215b4b5da1e6a9a'>boost</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/nix/boost?id=7136ea976f64aa10e93a61dd3215b4b5da1e6a9a&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2020-06-24 19:55:22 +0100'>2020-06-24</span></td><td><a href='/guix/commit/nix/boost?id=cd43b55da7ab51c996a7a3449c78f2a493616106'>nix: Tweak .gitignore files.</a><span class='msg-avail'>...<span class='msg-tooltip'>Remove .gitignore entries where they match source files that are tracked in
Git.  This is relevant to me at least, as some code searching tools use
.gitignore files and will ignore matched files.
</span></span></td><td>Christopher Baines</td></tr>
<tr><td><span title='2019-11-26 00:16:36 +0100'>2019-11-26</span></td><td><a href='/guix/commit/nix/boost?id=3a4d5ddd322c7daf0a8c83ca2c87c3fc38b19f0b'>daemon: boost::format: Fix typo "referred".</a><span class='msg-avail'>...<span class='msg-tooltip'>* nix/boost/format/exceptions.hpp (too_few_args): Fix typo.
  (too_many_args): Fix typo.

Signed-off-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</span></span></td><td>Vagrant Cascadian</td></tr>