fix(pydicom): reject non-finite affine metadata in PydicomReader

Validate ImageOrientationPatient, ImagePositionPatient, PixelSpacing and
lastImagePositionPatient values with math.isfinite before building the affine
matrix, raising ValueError on NaN/inf instead of propagating corrupted geometry
(GHSA-6hp3-vr39-rqw8).

Signed-off-by: R. Garcia-Dias <rafaelagd@gmail.com>

Author: garciadias

monai/data/image_reader.py

@@ -14,6 +14,7 @@
 import glob
 import gzip
 import io
+import math
 import os
 import re
 import tempfile
@@ -752,13 +753,29 @@ def _get_affine(self, metadata: dict, lps_to_ras: bool = True):
                 stacklevel=2,
             )
             return affine
+
+        def _raise_if_not_finite(value: Any, tag: str) -> None:
+            if not math.isfinite(value):
+                raise ValueError(
+                    f"PydicomReader: cannot derive affine matrix because DICOM tag {tag} "
+                    f"has a non-finite value: {value}."
+                )
+
         # "00200037" is the tag of `ImageOrientationPatient`
         rx, ry, rz, cx, cy, cz = metadata["00200037"]["Value"]
+        for value in (rx, ry, rz, cx, cy, cz):
+            _raise_if_not_finite(value, "ImageOrientationPatient (0020,0037)")
         # "00200032" is the tag of `ImagePositionPatient`
         sx, sy, sz = metadata["00200032"]["Value"]
+        for value in (sx, sy, sz):
+            _raise_if_not_finite(value, "ImagePositionPatient (0020,0032)")
         # "00280030" is the tag of `PixelSpacing`
         spacing = metadata["00280030"]["Value"] if "00280030" in metadata else (1.0, 1.0)
+        for value in spacing:
+            _raise_if_not_finite(value, "PixelSpacing (0028,0030)")
         dr, dc = metadata.get("spacing", spacing)[:2]
+        _raise_if_not_finite(dr, "spacing")
+        _raise_if_not_finite(dc, "spacing")
         affine[0, 0] = cx * dr
         affine[0, 1] = rx * dc
         affine[0, 3] = sx
@@ -773,6 +790,8 @@ def _get_affine(self, metadata: dict, lps_to_ras: bool = True):
         # 3d
         if "lastImagePositionPatient" in metadata:
             t1n, t2n, t3n = metadata["lastImagePositionPatient"]
+            for value in (t1n, t2n, t3n):
+                _raise_if_not_finite(value, "lastImagePositionPatient")
             n = metadata[MetaKeys.SPATIAL_SHAPE][-1]
             if n > 1:
                 affine[0, 2] = (t1n - sx) / (n - 1)

tests/data/test_pydicom_reader.py

@@ -39,6 +39,40 @@ def test_partial_orientation_tags_warns(self):
             affine = reader._get_affine(metadata)
         np.testing.assert_array_equal(affine, np.eye(4))
 
+    def test_non_finite_pixel_spacing_raises(self):
+        reader = PydicomReader()
+        metadata = {
+            "00200037": {"Value": [1.0, 0.0, 0.0, 0.0, 1.0, 0.0]},
+            "00200032": {"Value": [0.0, 0.0, 0.0]},
+            "00280030": {"Value": [np.nan, 1.0]},
+        }
+        with self.assertRaisesRegex(ValueError, "PixelSpacing"):
+            reader._get_affine(metadata, lps_to_ras=False)
+
+    def test_non_finite_image_position_raises(self):
+        reader = PydicomReader()
+        metadata = {
+            "00200037": {"Value": [1.0, 0.0, 0.0, 0.0, 1.0, 0.0]},
+            "00200032": {"Value": [np.inf, 0.0, 0.0]},
+            "00280030": {"Value": [1.0, 1.0]},
+        }
+        with self.assertRaisesRegex(ValueError, "ImagePositionPatient"):
+            reader._get_affine(metadata, lps_to_ras=False)
+
+    def test_finite_values_return_affine(self):
+        reader = PydicomReader()
+        metadata = {
+            "00200037": {"Value": [1.0, 0.0, 0.0, 0.0, 1.0, 0.0]},
+            "00200032": {"Value": [10.0, 20.0, 30.0]},
+            "00280030": {"Value": [0.5, 0.25]},
+        }
+        affine = reader._get_affine(metadata, lps_to_ras=False)
+        self.assertEqual(affine.shape, (4, 4))
+        self.assertTrue(np.all(np.isfinite(affine)))
+        np.testing.assert_allclose(affine[0, 3], 10.0)
+        np.testing.assert_allclose(affine[1, 3], 20.0)
+        np.testing.assert_allclose(affine[2, 3], 30.0)
+
 
 if __name__ == "__main__":
     unittest.main()