ILSpy

9645 Commits

54 Branches

94 Tags

91 MiB

Branch: fix/lambda-parameter-syntax

Commit Graph

Author	SHA1	Message	Date
Siegfried Pammer	d9c60f08b0	Fix crash decompiling reference assemblies with stripped method bodies The accessor forwarding-stub matcher bounded the IL body from above but not from below. Reference assemblies keep the method RVA while stripping the body to zero bytes, so an explicit interface accessor there sailed past the size check and the first opcode read ran off the end of the blob, aborting the whole type with a BadImageFormatException. The sibling matcher in TransformDisplayClassUsage already guards its lower bound; this one did not. Found by fuzzing nuget.org: every package resolving to the Microsoft.NETFramework.ReferenceAssemblies packs was affected. Assisted-by: Claude:claude-opus-5[1m]:Claude Code	1 month ago

Author

SHA1

Message

Date

Siegfried Pammer

d9c60f08b0

Fix crash decompiling reference assemblies with stripped method bodies

The accessor forwarding-stub matcher bounded the IL body from above but not
from below. Reference assemblies keep the method RVA while stripping the body
to zero bytes, so an explicit interface accessor there sailed past the size
check and the first opcode read ran off the end of the blob, aborting the
whole type with a BadImageFormatException. The sibling matcher in
TransformDisplayClassUsage already guards its lower bound; this one did not.

Found by fuzzing nuget.org: every package resolving to the
Microsoft.NETFramework.ReferenceAssemblies packs was affected.

Assisted-by: Claude:claude-opus-5[1m]:Claude Code

1 month ago

1 Commits (fix/lambda-parameter-syntax)