microsoft / microsoft/Tools-for-Health-Data-Anonymization

[DICOM] Prevent overflow when matching crypto hash output length

Open
#265 0 comments 1 reaction 2 assignees View on GitHub

@jovinson-ms is already working on this.

Since Aug 13, 2026.

  • #266 by @copilot-swe-agent — open
Dominant language
C#
Stars
309
Forks
90
PR merge metrics
No merged PRs in 30d

Description

Summary

CryptoHashFunction.GenerateOutputOfSameLength throws System.OverflowException when MatchInputStringLength is enabled and the input length exceeds the range supported by Int64.

The implementation parses an all-nine string as long:

long maxNumberGivenDigits = long.Parse(new string('9', input.Length));

A 19-character input exceeds Int64.MaxValue. In the DICOM anonymizer pipeline, this causes metadata de-identification to fail after earlier processing stages complete.

Reproduction

  1. Configure crypto hashing with MatchInputStringLength = true.
  2. Call CryptoHashFunction.Hash with a numeric string of 19 or more characters.
  3. Observe System.OverflowException from GenerateOutputOfSameLength / Int64.Parse.

Expected behavior

Length-preserving hashing should support valid DICOM string lengths without converting an all-nine bound to Int64. The output should remain deterministic, numeric-only, and exactly match the input length.

Acceptance criteria

  • Remove the Int64-bounded length-preserving implementation.
  • Preserve existing deterministic behavior for supported lengths where practical.
  • Add boundary tests for 18-, 19-, and longer-character inputs.
  • Verify output is numeric-only and exactly matches the input length.
  • Do not include input values in exceptions or logs.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.