ILSpy

9597 Commits

54 Branches

94 Tags

91 MiB

Branch: compound-assignment-operators

Commit Graph

Author SHA1 Message Date

Author	SHA1	Message	Date
Christoph Wille	4a2a0efc13	Bound .rsrc resource-tree parsing against crafted input ReadWin32Resources walked the PE resource directory tree with raw native pointer arithmetic over attacker-controlled offsets, counts and sizes, with no bounds checks, no recursion-depth limit and no cycle detection. The root section pointer came from GetSectionData, whose length was read and then discarded, leaving every dereference unbounded. A crafted assembly could therefore turn merely opening it (the Save as project feature reads these resources unconditionally) into an uncatchable process kill or an out-of-bounds native read: a subdirectory entry pointing back at itself recursed until the stack overflowed; an inflated entry count walked off the section end; and a data entry whose Size was up to 4 GB made Buffer.MemoryCopy read far past the section, faulting on an unmapped page or copying adjacent process memory into the byte[] later written to app.ico/app.manifest on disk. None of this is containable, since a StackOverflowException cannot be caught and the repo has no corrupted-state exception handling. This is the sibling of the bundle signature fix in `a154a7bbb`. Carry the section length alongside the root pointer and bounds-check every offset, entry count, name-string length and data Size against it, cap recursion depth and track visited directory offsets to break cycles. A hostile or truncated file now yields a bounded, partial tree instead of a crash; well-formed resources parse exactly as before. The parser no longer needs the whole PEReader, only a delegate that resolves a data RVA to a bounded pointer, which is the seam the new tests drive over a pinned buffer. Assisted-by: Claude:claude-opus-4-8:Claude Code	3 months ago

Christoph Wille

4a2a0efc13

Bound .rsrc resource-tree parsing against crafted input

ReadWin32Resources walked the PE resource directory tree with raw native pointer
arithmetic over attacker-controlled offsets, counts and sizes, with no bounds
checks, no recursion-depth limit and no cycle detection. The root section pointer
came from GetSectionData, whose length was read and then discarded, leaving every
dereference unbounded.

A crafted assembly could therefore turn merely opening it (the Save as project
feature reads these resources unconditionally) into an uncatchable process kill or
an out-of-bounds native read: a subdirectory entry pointing back at itself recursed
until the stack overflowed; an inflated entry count walked off the section end; and
a data entry whose Size was up to 4 GB made Buffer.MemoryCopy read far past the
section, faulting on an unmapped page or copying adjacent process memory into the
byte[] later written to app.ico/app.manifest on disk. None of this is containable,
since a StackOverflowException cannot be caught and the repo has no corrupted-state
exception handling. This is the sibling of the bundle signature fix in a154a7bbb.

Carry the section length alongside the root pointer and bounds-check every offset,
entry count, name-string length and data Size against it, cap recursion depth and
track visited directory offsets to break cycles. A hostile or truncated file now
yields a bounded, partial tree instead of a crash; well-formed resources parse
exactly as before. The parser no longer needs the whole PEReader, only a delegate
that resolves a data RVA to a bounded pointer, which is the seam the new tests drive
over a pinned buffer.

Assisted-by: Claude:claude-opus-4-8:Claude Code

3 months ago

1 Commits (compound-assignment-operators)