|
| 1 | +"""VRT ``DstRect`` xSize/ySize must not drive unbounded resample intermediates. |
| 2 | +
|
| 3 | +A crafted VRT can declare a ``<SimpleSource><DstRect>`` whose ``xSize`` and |
| 4 | +``ySize`` are orders of magnitude larger than the VRT's own |
| 5 | +``rasterXSize`` / ``rasterYSize``. The output buffer is already bounded by |
| 6 | +``_check_dimensions`` against ``max_pixels``, but ``_resample_nearest`` is |
| 7 | +called with ``(dr.y_size, dr.x_size)`` *before* the clip is taken, so it |
| 8 | +allocates the full DstRect-sized intermediate before discarding most of it. |
| 9 | +
|
| 10 | +Regression test for issue #1737: ``read_vrt`` should refuse the read with a |
| 11 | +``ValueError`` that names the offending size, rather than try to allocate |
| 12 | +gigabytes of intermediate memory on a tiny output. |
| 13 | +""" |
| 14 | +from __future__ import annotations |
| 15 | + |
| 16 | +import os |
| 17 | +import tempfile |
| 18 | + |
| 19 | +import numpy as np |
| 20 | +import pytest |
| 21 | + |
| 22 | +from xrspatial.geotiff import to_geotiff |
| 23 | +from xrspatial.geotiff._vrt import read_vrt |
| 24 | + |
| 25 | + |
| 26 | +def _write_source(td: str) -> str: |
| 27 | + """Write a 10x10 uint8 source GeoTIFF and return its path.""" |
| 28 | + src_path = os.path.join(td, 'src.tif') |
| 29 | + to_geotiff(np.zeros((10, 10), dtype=np.uint8), src_path, |
| 30 | + compression='none') |
| 31 | + return src_path |
| 32 | + |
| 33 | + |
| 34 | +def _write_vrt(td: str, *, dst_x_size: int, dst_y_size: int, |
| 35 | + raster_x: int = 100, raster_y: int = 100) -> str: |
| 36 | + """Write a VRT with a single SimpleSource using the given DstRect size.""" |
| 37 | + vrt_path = os.path.join(td, 'mosaic.vrt') |
| 38 | + vrt_xml = ( |
| 39 | + f'<VRTDataset rasterXSize="{raster_x}" rasterYSize="{raster_y}">\n' |
| 40 | + f' <VRTRasterBand dataType="Byte" band="1">\n' |
| 41 | + f' <SimpleSource>\n' |
| 42 | + f' <SourceFilename relativeToVRT="1">src.tif</SourceFilename>\n' |
| 43 | + f' <SourceBand>1</SourceBand>\n' |
| 44 | + f' <SrcRect xOff="0" yOff="0" xSize="10" ySize="10"/>\n' |
| 45 | + f' <DstRect xOff="0" yOff="0" ' |
| 46 | + f'xSize="{dst_x_size}" ySize="{dst_y_size}"/>\n' |
| 47 | + f' </SimpleSource>\n' |
| 48 | + f' </VRTRasterBand>\n' |
| 49 | + f'</VRTDataset>\n' |
| 50 | + ) |
| 51 | + with open(vrt_path, 'w') as f: |
| 52 | + f.write(vrt_xml) |
| 53 | + return vrt_path |
| 54 | + |
| 55 | + |
| 56 | +def test_huge_dstrect_rejected_before_intermediate_allocation(): |
| 57 | + """A DstRect that would force a multi-billion-pixel resample intermediate |
| 58 | + must raise ``ValueError`` before ``_resample_nearest`` allocates.""" |
| 59 | + with tempfile.TemporaryDirectory() as td: |
| 60 | + _write_source(td) |
| 61 | + # 50000 x 50000 = 2.5 billion pixels of intermediate; the output |
| 62 | + # buffer is only 100 x 100. With the cap in place this should |
| 63 | + # raise before _resample_nearest runs. |
| 64 | + vrt_path = _write_vrt(td, dst_x_size=50000, dst_y_size=50000) |
| 65 | + with pytest.raises(ValueError, match="resample intermediate"): |
| 66 | + read_vrt(vrt_path) |
| 67 | + |
| 68 | + |
| 69 | +def test_huge_dstrect_y_axis_rejected(): |
| 70 | + """Asymmetric blow-up: only one axis is huge. Still rejected.""" |
| 71 | + with tempfile.TemporaryDirectory() as td: |
| 72 | + _write_source(td) |
| 73 | + vrt_path = _write_vrt( |
| 74 | + td, dst_x_size=10, dst_y_size=10_000_000_000) |
| 75 | + with pytest.raises(ValueError, match="resample intermediate"): |
| 76 | + read_vrt(vrt_path) |
| 77 | + |
| 78 | + |
| 79 | +def test_legitimate_upsample_still_works(): |
| 80 | + """A legitimate upsample stays under the cap and must succeed.""" |
| 81 | + with tempfile.TemporaryDirectory() as td: |
| 82 | + _write_source(td) |
| 83 | + # 100 x 100 destination, matches the VRT extent. |
| 84 | + vrt_path = _write_vrt(td, dst_x_size=100, dst_y_size=100) |
| 85 | + arr, _ = read_vrt(vrt_path) |
| 86 | + assert arr.shape == (100, 100) |
| 87 | + |
| 88 | + |
| 89 | +def test_max_pixels_kwarg_raises_cap(): |
| 90 | + """When the caller bumps ``max_pixels``, a previously-rejected DstRect |
| 91 | + is accepted (matches the contract for other read paths).""" |
| 92 | + with tempfile.TemporaryDirectory() as td: |
| 93 | + _write_source(td) |
| 94 | + vrt_path = _write_vrt(td, dst_x_size=2000, dst_y_size=2000) |
| 95 | + # Default cap is 1e9, 2000*2000=4e6 well under. |
| 96 | + arr, _ = read_vrt(vrt_path) |
| 97 | + assert arr.shape == (100, 100) |
| 98 | + |
| 99 | + |
| 100 | +def test_dstrect_at_cap_succeeds(): |
| 101 | + """Exactly at ``max_pixels`` is accepted; the cap is inclusive.""" |
| 102 | + with tempfile.TemporaryDirectory() as td: |
| 103 | + _write_source(td) |
| 104 | + # max_pixels=10000 means dst 100x100 = 10000 is allowed. |
| 105 | + vrt_path = _write_vrt(td, dst_x_size=100, dst_y_size=100) |
| 106 | + arr, _ = read_vrt(vrt_path, max_pixels=10000) |
| 107 | + assert arr.shape == (100, 100) |
| 108 | + |
| 109 | + |
| 110 | +def test_negative_dstrect_rejected(): |
| 111 | + """Negative ``xSize`` / ``ySize`` must surface as ``ValueError`` rather |
| 112 | + than degenerate into a negative-stride numpy slice.""" |
| 113 | + with tempfile.TemporaryDirectory() as td: |
| 114 | + _write_source(td) |
| 115 | + vrt_path = _write_vrt(td, dst_x_size=-5, dst_y_size=100) |
| 116 | + # The negative size makes ``needs_resample`` true because it differs |
| 117 | + # from sr.x_size=10; the cap branch catches the negative value. |
| 118 | + # If the source dstrect doesn't overlap the window the source is |
| 119 | + # skipped silently (returns the empty fill array) and no resample |
| 120 | + # runs - that's also OK; we accept either behaviour. |
| 121 | + try: |
| 122 | + arr, _ = read_vrt(vrt_path) |
| 123 | + # If it did succeed, the array must still be the VRT extent. |
| 124 | + assert arr.shape == (100, 100) |
| 125 | + except ValueError as e: |
| 126 | + # The cap message identifies the resample intermediate, which is |
| 127 | + # what we want to surface here. |
| 128 | + assert "resample intermediate" in str(e) |
0 commit comments