From c803b71a474fbfce7040008c5554284462b91221 Mon Sep 17 00:00:00 2001
From: Siegfried Pammer <siegfriedpammer@gmail.com>
Date: Mon, 6 Jul 2026 09:48:06 +0200
Subject: [PATCH] Guard against nil field tokens in the localloc cpblk prefix

HandleCpblkInitializer already rejects fields with a nil metadata token
before casting to FieldDefinitionHandle; the localloc prefix path did
not, so a crafted assembly could make GetFieldDefinition throw instead
of the transform being skipped.

Assisted-by: Claude:claude-fable-5:Claude Code
---
 .../IL/Transforms/TransformArrayInitializers.cs                 | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ICSharpCode.Decompiler/IL/Transforms/TransformArrayInitializers.cs b/ICSharpCode.Decompiler/IL/Transforms/TransformArrayInitializers.cs
index cc28da86d..85fbe01c8 100644
--- a/ICSharpCode.Decompiler/IL/Transforms/TransformArrayInitializers.cs
+++ b/ICSharpCode.Decompiler/IL/Transforms/TransformArrayInitializers.cs
@@ -518,6 +518,8 @@ namespace ICSharpCode.Decompiler.IL.Transforms
 					return;
 				if (!MatchGetStaticFieldAddress(src, out var field))
 					return;
+				if (field.MetadataToken.IsNil)
+					return;
 				var fd = context.PEFile.Metadata.GetFieldDefinition((FieldDefinitionHandle)field.MetadataToken);
 				if (!fd.HasFlag(System.Reflection.FieldAttributes.HasFieldRVA))
 					return;