| 50 | 50 | * GDAL and OGR driver do not always use file extensions to determine which file must be handled by which driver (this is a feature in most situations !). But, for example, a VRT file might be disguised as a .tif, .png, or .jpg file. So you cannot know which driver will handle a file by just looking at its extensions. Using "gdalmanage identify the.file" can be a means to know the driver without attempting a full open of the file, but, drivers not having a specialized implementation of the Identify() method will resort to the Open() method. |
| 51 | 51 | * Drivers depending on third-party libraries whose code has been embedded in GDAL. Binary builds might rely on the internal version, or the external version. If using the internal version, they might use an obsolete version of the third-party library that might contain known vulnerabilities. Potentially concerned drivers are GTiff (libtiff, libgeotiff), PNG (libpng), GIF (giflib), JPEG (libjpeg), PCRaster (libcsf), GeoJSON (libjson-c), MapInfo File (MITAB lib), AVCBin/AVCE00 (AVCE00 lib). An internal version of ZLib is also contained in GDAL sources. Packagers of GDAL are recommanded to use the external version of the libraries when possible (might be impractical with libtiff due to the libtiff 4.X vs libtiff 3.X issue), so that security upgrades of those dependencies benefit to GDAL. |
| 52 | | * Drivers using GDALOpen() or OGROpen() internally cause other drivers to be used (and their possible flows exploited), without it being obvious at first sight. VRT, MBTiles, KMLSuperOverlay, RasterLite, PDF, RPFTOC, RS2, WMS, WCS, WFS, ... are such drivers. |
| 53 | | * Drivers depending on downloaded data (HTTP, WMS, WCS, WFS). A subset of the previously mentionned drivers, but where the hostile payload might come from the Web, so local inspection of content is not sufficient. |
| | 52 | * Drivers using GDALOpen() or OGROpen() internally cause other drivers to be used (and their possible flows exploited), without it being obvious at first sight. VRT, MBTiles, KMLSuperOverlay, RasterLite, PCIDSK, PDF, RPFTOC, RS2, WMS, WCS, WFS, ... are such drivers. |
| | 53 | * Drivers depending on downloaded data (HTTP, DODS, WMS, WCS, WFS). A subset of the previously mentionned drivers, but where the hostile payload might come from the Web, so local inspection of content is not sufficient. |
| | 54 | * Other drivers can access remote ressources. On GDAL side : ECW (through ecwp://), PostGISRaster, RASDAMAN, GeoRaster, SDE. On OGR side : to-be-done |
