Fix KDE all-zero output with descending-coordinate templates#1199
Merged
brendancol merged 3 commits intomasterfrom Apr 14, 2026
Merged
Fix KDE all-zero output with descending-coordinate templates#1199brendancol merged 3 commits intomasterfrom
brendancol merged 3 commits intomasterfrom
Conversation
Two security fixes for the geotiff subpackage: 1. Add a configurable max_pixels guard to read_to_array() and all internal read functions (_read_strips, _read_tiles, _read_cog_http). A crafted TIFF with fabricated header dimensions could previously trigger multi-TB allocations. The default limit is 1 billion pixels (~4 GB for float32 single-band), overridable via max_pixels kwarg. Fixes #1184. 2. Canonicalize VRT source filenames with os.path.realpath() after resolving relative paths. Previously, a VRT file with "../" in SourceFilename could read arbitrary files outside the VRT directory. Fixes #1185.
os.path.realpath() converts Unix-style paths to Windows paths on Windows (e.g. /data/tile.tif becomes D:\data\tile.tif). Use os.path.realpath() in the assertion so it matches the production code's canonicalization on all platforms.
The bounding-box index calculation in _kde_cpu and _line_density_cpu divided by dx/dy to convert coordinate offsets to pixel indices. When dy or dx was negative (descending coordinates, common for north-up rasters), the division flipped lo/hi so the inner loops never executed, producing all-zero output. Fix: compute both index endpoints and use min/max to get the correct lo and hi regardless of spacing sign.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1198
Proposed changes
_kde_cpuand_line_density_cputo handle negativedx/dy(descending coordinate order). The old code divided bydx/dyto get pixel indices, but negative spacing flipped lo and hi so the inner loops never executed, producing all-zero output.Test plan
test_kde.pytests still passTestDescendingCoordinatestests pass, covering: