Cap VRT DstRect resample intermediate against max_pixels (#1737)

[brendancol]

Summary

• Closes geotiff: VRT SimpleSource DstRect xSize/ySize allows unbounded intermediate allocation in _resample_nearest #1737. A crafted VRT could declare a <SimpleSource><DstRect xSize ySize> orders of magnitude larger than the VRT's rasterXSize / rasterYSize. _resample_nearest then allocated (dr.y_size, dr.x_size) before the clip was taken, demanding multi-gigabyte intermediates on tiny outputs (10x10 source with DstRect 50000x50000 against a 100x100 VRT extent reached ~2.5 GB of uint8 in np.repeat).
• Reject sizes that exceed max_pixels in read_vrt before _resample_nearest runs. Mirrors the _check_dimensions pattern already used by the tile / strip / HTTP / dask readers.
• Six new tests in test_vrt_dstrect_resample_cap_1737.py cover huge X, huge Y, legitimate, max_pixels override, at-cap, and negative cases.

Test plan

• pytest xrspatial/geotiff/tests/test_vrt_dstrect_resample_cap_1737.py (6 new, all pass)
• pytest xrspatial/geotiff/tests/ -k vrt (201 existing VRT tests pass)
• Demonstrate the unbounded allocation on main is now rejected with ValueError

[Copilot]

Pull request overview

This PR hardens the GeoTIFF VRT reader against denial-of-service via crafted <SimpleSource><DstRect xSize/ySize> values that force _resample_nearest to allocate unbounded intermediate arrays, by adding an explicit max_pixels-based cap in read_vrt and adding regression tests for the reported cases.

Changes:

• Add a resample-intermediate size guard in xrspatial/geotiff/_vrt.py:read_vrt() to reject oversized DstRect resample intermediates before allocation.
• Add a new regression test module covering oversized X/Y, legitimate upsample, max_pixels behavior, at-cap behavior, and negative-size cases.
• Update the sweep-security audit state CSV entry to record the finding and fix status.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
xrspatial/geotiff/_vrt.py	Adds a max_pixels-based validation guard to prevent unbounded resample intermediate allocations from malicious VRT DstRect sizes.
xrspatial/geotiff/tests/test_vrt_dstrect_resample_cap_1737.py	Introduces regression tests intended to ensure oversized DstRect resample intermediates are rejected and normal cases still work.
.claude/sweep-security-state.csv	Records the security sweep finding (#1737) and notes the mitigation approach.

Comments suppressed due to low confidence (1)

xrspatial/geotiff/tests/test_vrt_dstrect_resample_cap_1737.py:120

• The negative-DstRect test is internally inconsistent: the docstring/name say negative sizes "must surface as ValueError", but the test explicitly allows success, and the in-line comment claims the "cap branch catches the negative value" even though read_vrt skips non-overlapping rects before the cap check (negative xSize/ySize makes dst_c1/dst_r1 < dst_c0/dst_r0, so it will always be treated as no-overlap and continue). Update the test and comments to match the actual behavior you want (either assert it is rejected via earlier validation, or assert it is skipped and returns the fill array).

def test_negative_dstrect_rejected():
    """Negative ``xSize`` / ``ySize`` must surface as ``ValueError`` rather
    than degenerate into a negative-stride numpy slice."""
    with tempfile.TemporaryDirectory() as td:
        _write_source(td)
        vrt_path = _write_vrt(td, dst_x_size=-5, dst_y_size=100)
        # The negative size makes ``needs_resample`` true because it differs
        # from sr.x_size=10; the cap branch catches the negative value.
        # If the source dstrect doesn't overlap the window the source is
        # skipped silently (returns the empty fill array) and no resample
        # runs - that's also OK; we accept either behaviour.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[brendancol]

Restructured both test_max_pixels_kwarg_raises_cap and test_dstrect_at_cap_succeeds in c0f9ab8. Each now asserts rejection under a tiny max_pixels, then asserts success after the cap is bumped, using the same VRT across both calls. I also shrank the VRT raster to 10x10 so the output buffer stays under _check_dimensions; otherwise the dimensions guard rejects first and the resample-intermediate check is never exercised.

[brendancol]

Yep, unreachable: a negative size makes dst_*1 < dst_*0 so the overlap continue always fires first. In c0f9ab8 I moved the negative-size validation ahead of the overlap math and gave it a tailored message ("negative size" rather than "exceeds" the pixel cap). The remaining cap branch just enforces the pixel budget. I also added test_negative_dstrect_y_size_rejected and tightened test_negative_dstrect_rejected to assert against the new error string.