티스토리 수익 글 보기

티스토리 수익 글 보기

[6.0.x] Fixed CVE-2026-53877 — Prevented heap buffer over-read when … · django/django@38dfbd2 · GitHub
Skip to content

Commit 38dfbd2

Browse files
jacobtylerwallsjacobtylerwalls
committed
[6.0.x] Fixed CVE-2026-53877 — Prevented heap buffer over-read when creating GDALRaster from bytes.
Previously, `sys.getsizeof()` included the size of the `PyBytesObject` wrapper which is bigger. `len(bytes_object)` is the accurate size. Thanks Bence Nagy for the report, and Simon Charette for reviews. Backport of 6ca2bbe from main.
1 parent 64f9a2b commit 38dfbd2

4 files changed

Lines changed: 35 additions & 2 deletions

File tree

‎django/contrib/gis/gdal/raster/source.py‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
import json
22
import os
3-
import sys
43
import uuid
54
from ctypes import (
65
addressof,
@@ -103,7 +102,7 @@ def __init__(self, ds_input, write=False):
103102
# Create a new raster in write mode.
104103
self._write = 1
105104
# Get size of buffer.
106-
size = sys.getsizeof(ds_input)
105+
size = len(ds_input)
107106
# Pass data to ctypes, keeping a reference to the ctypes object so
108107
# that the vsimem file remains available until the GDALRaster is
109108
# deleted.

‎docs/releases/5.2.16.txt‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,17 @@ stored in Django's shared cache.
1919

2020
This issue has severity "low" according to the :ref:`Django security policy
2121
<severity-levels>`.
22+
23+
CVE-2026-53877: Heap buffer over-read in ``GDALRaster``
24+
=======================================================
25+
26+
When :class:`~django.contrib.gis.gdal.GDALRaster` was instantiated with a bytes
27+
object representing a raster file, the
28+
:attr:`~django.contrib.gis.gdal.GDALRaster.vsi_buffer` property could over-read
29+
the allocated buffer by approximately 32 bytes. This could result in
30+
information disclosure of adjacent heap memory or, in rare cases, a
31+
segmentation fault. Only rasters stored in GDAL's virtual filesystem were
32+
affected.
33+
34+
This issue has severity "low" according to the :ref:`Django security policy
35+
<severity-levels>`.

‎docs/releases/6.0.7.txt‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,20 @@ stored in Django's shared cache.
2121
This issue has severity "low" according to the :ref:`Django security policy
2222
<severity-levels>`.
2323

24+
CVE-2026-53877: Heap buffer over-read in ``GDALRaster``
25+
=======================================================
26+
27+
When :class:`~django.contrib.gis.gdal.GDALRaster` was instantiated with a bytes
28+
object representing a raster file, the
29+
:attr:`~django.contrib.gis.gdal.GDALRaster.vsi_buffer` property could over-read
30+
the allocated buffer by approximately 32 bytes. This could result in
31+
information disclosure of adjacent heap memory or, in rare cases, a
32+
segmentation fault. Only rasters stored in GDAL's virtual filesystem were
33+
affected.
34+
35+
This issue has severity "low" according to the :ref:`Django security policy
36+
<severity-levels>`.
37+
2438
Bugfixes
2539
========
2640

‎tests/gis_tests/gdal_tests/test_raster.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,12 @@ def test_vsi_buffer_property(self):
265265
# The vsi buffer is None for rasters that are not vsi based.
266266
self.assertIsNone(self.rs.vsi_buffer)
267267

268+
def test_vsi_buffer_length(self):
269+
with open(self.rs_path, "rb") as rst_file:
270+
rst_bytes = rst_file.read()
271+
vsimem = GDALRaster(rst_bytes)
272+
self.assertEqual(len(vsimem.vsi_buffer), len(rst_bytes))
273+
268274
def test_vsi_vsizip_filesystem(self):
269275
rst_zipfile = NamedTemporaryFile(suffix=".zip")
270276
with zipfile.ZipFile(rst_zipfile, mode="w") as zf:

0 commit comments

Comments
 (0)