Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
osgeo/gdal
master @ de7467b
10
Fixes
12
CVEs
CRITICAL
Peak severity
44.4%
Coverage
Highlights
Integer Overflow: 4 prior fixes. Scrutinize any change in this area.
frmts/lerc/lercdriver.cpp: most-fixed (4 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Integer Overflow: The LERC driver is highly susceptible to integer overflows when validating row, column, and band dimensions, which directly leads to downstream heap corruption during memory allocation. Developers must ensure all dimensional multiplications are explicitly bound checked against maximum type limits.
Buffer Overflow: Mismatches in dimension structures—such as allocating mask buffers based on band counts instead of actual mask counts when processing multi-band files with a single mask—consistently result in out-of-bounds heap operations.
Integer Overflow: Embedded copy-paste or vendored dependencies like libtiff contain classic integer overflows in tag directory parsing (specifically colormaps, transfer functions, and raw seek offsets), leading to severe heap out-of-bounds reads and writes.