Skip to content

bilateral: unbounded sigma_spatial enables memory and compute DoS #1236

Description

@brendancol

Describe the bug

bilateral() in xrspatial/bilateral.py validates sigma_spatial only as > 0, with no upper bound. The kernel radius is computed as radius = ceil(2 * sigma_spatial) and then used to pad the input (when boundary != 'nan') and to size the neighborhood loop in both the numba CPU kernel and the CUDA kernel.

Padding allocates shape (H + 2*radius, W + 2*radius), so the allocation scales quadratically in sigma_spatial. With no cap, one float from the caller can DoS the host:

  • sigma_spatial=1e9 on a 100x100 raster gives radius=2_000_000_000. The padded float64 array would need about 1.28 x 10^20 bytes (128 EB).
  • sigma_spatial=1e5 gives radius 200000, about 320 GB padded on any input.
  • Even with boundary='nan' (no padding), the clamped inner loop runs min(rows, 2r+1) * min(cols, 2r+1) iterations per pixel. On a 10000x10000 raster with sigma_spatial=10000, that is roughly 10^16 ops.

Expected behavior

Reject sigma_spatial values whose derived radius exceeds max(rows, cols) with a ValueError that names the offending value and the cap. A radius that large already covers the whole raster.

Reproduction

import numpy as np
import xarray as xr
from xrspatial import bilateral

agg = xr.DataArray(np.zeros((100, 100)))
bilateral(agg, sigma_spatial=1e9)  # tries to allocate exabytes or runs effectively forever

Affected backends

numpy, cupy, dask+numpy, dask+cupy. The check lives in the public entrypoint, so one cap covers every backend.

Severity

HIGH. A caller passing one float to the public API can exhaust server memory or CPU.

Category

Cat 1 (Unbounded allocation / DoS) per the security sweep.

Additional context

Found during the bilateral security sweep on 2026-04-23. One-fix-per-PR convention applies.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinghigh-priorityinput-validationInput validation and error messagesoomOut-of-memory risk with large datasets

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions