From a6e06b6c68476230c7ae99f8dc2b5106c55c26f6 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Sun, 19 Jul 2026 12:01:19 +0200
Subject: [PATCH] dcmtk: patch CVE-2026-5663

Backport upstream commit edbb085e, which sanitizes values substituted into storescp execution hooks to prevent remote command injection.

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
---
 pkgs/by-name/dc/dcmtk/package.nix | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/dc/dcmtk/package.nix b/pkgs/by-name/dc/dcmtk/package.nix
index 7589e47a0213..a2ee1b9696e9 100644
--- a/pkgs/by-name/dc/dcmtk/package.nix
+++ b/pkgs/by-name/dc/dcmtk/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   fetchurl,
   zlib,
   libtiff,
@@ -23,9 +24,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-JUF3IX0LOtpeAJPuTbAJo79sCuPuhh7KNIuQJfcFN/A=";
   };
 
-  # The following patches are taken from the Debian package
-  # See https://salsa.debian.org/med-team/dcmtk
   patches = [
+    # Remove when updating past 3.7.0.
+    (fetchpatch {
+      name = "CVE-2026-5663.patch";
+      url = "https://github.com/DCMTK/dcmtk/commit/edbb085e45788dccaf0e64d71534cfca925784b8.patch";
+      hash = "sha256-aSK/G5zI1Zyz0aonxnbWP/W5Ra6xCBYGxgPhM+05LXs=";
+    })
+    # The following patches are taken from the Debian package
+    # See https://salsa.debian.org/med-team/dcmtk
     (fetchurl {
       url = "https://salsa.debian.org/med-team/dcmtk/-/raw/debian/3.6.9-4/debian/patches/01_dcmtk_3.6.0-1.patch";
       hash = "sha256-kDEZvPqcF8+PYID24srMoPSBPltmnGiJ67LHsLVcPYM=";