| tiêu đề | laspy 2.7.0 Uncontrolled Memory Allocation |
|---|
| Mô tả | laspy up to 2.7.0 is affected by uncontrolled memory allocation leading to denial of service. When reading a LAS file, the reader takes the point count field directly from the attacker-controlled LAS header and allocates a buffer sized point_count multiplied by the point size (laspy/lasreader.py around line 335) before validating that value against the actual file size. A tiny crafted file can therefore declare an enormous point count and force a huge allocation. Runtime verified against the latest release: a 227-byte crafted file drives an allocation request of about 85 GB, with measured real RSS of 614 MB before failure, which is enough to crash or hang any service that parses untrusted LAS input. CWE-789. CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5. Suggested fix: validate the declared point count against the remaining file size before allocating. |
|---|
| Nguồn | ⚠️ https://github.com/laspy/laspy/issues/378 |
|---|
| Người dùng | Anonymous User |
|---|
| Đệ trình | 12/10/2026 20:24 (cách đây 23 ngày) |
|---|
| Kiểm duyệt | 04/11/2026 17:03 (23 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 431136 [laspy đến 2.7.0 LAS File laspy/lasreader.py Từ chối dịch vụ] |
|---|
| điểm | 20 |
|---|