ILSpy

9645 Commits

54 Branches

94 Tags

91 MiB

Branch: fix/lambda-parameter-syntax

Commit Graph

Author	SHA1	Message	Date
Christoph Wille	c74990d987	Share the bundle signature with the tests instead of copying it Two test fixtures carried their own copy of the 32-byte signature, which would silently drift from the real one. The signature is now an internal member of SingleFileBundle and ILSpy.Tests gets internals access to the decompiler assembly, matching what ILSpyX already grants it. Assisted-by: Claude:claude-fable-5:Claude Code	3 weeks ago
Christoph Wille	4980c011b8	Never size bundle entry decompression from the manifest's declared size A single-file bundle manifest is attacker-controlled. Opening a compressed entry pre-allocated a MemoryStream of the declared decompressed size through an unchecked long-to-int cast, then inflated the whole deflate stream before comparing lengths. A few-byte payload declaring ~2 GB thus forced a ~2 GB allocation up front, sizes at or above 2 GB wrapped to a negative capacity, and a decompression bomb was expanded in full before the mismatch was noticed (CWE-789, CWE-197). Grow the buffer only with bytes the deflate stream actually produces and stop reading one byte past the declared size, which already proves the entry corrupt. Reject declared sizes that cannot fit a single in-memory buffer as invalid bundle data. Entry offsets need no extra check: the UnmanagedMemoryStream over the mapping already validates them against the view length. Assisted-by: Claude:claude-fable-5:Claude Code	3 weeks ago

Author

SHA1

Message

Date

Christoph Wille

c74990d987

Share the bundle signature with the tests instead of copying it

Two test fixtures carried their own copy of the 32-byte signature, which
would silently drift from the real one. The signature is now an internal
member of SingleFileBundle and ILSpy.Tests gets internals access to the
decompiler assembly, matching what ILSpyX already grants it.

Assisted-by: Claude:claude-fable-5:Claude Code

3 weeks ago

Christoph Wille

4980c011b8

Never size bundle entry decompression from the manifest's declared size

A single-file bundle manifest is attacker-controlled. Opening a compressed
entry pre-allocated a MemoryStream of the declared decompressed size
through an unchecked long-to-int cast, then inflated the whole deflate
stream before comparing lengths. A few-byte payload declaring ~2 GB thus
forced a ~2 GB allocation up front, sizes at or above 2 GB wrapped to a
negative capacity, and a decompression bomb was expanded in full before
the mismatch was noticed (CWE-789, CWE-197).

Grow the buffer only with bytes the deflate stream actually produces and
stop reading one byte past the declared size, which already proves the
entry corrupt. Reject declared sizes that cannot fit a single in-memory
buffer as invalid bundle data. Entry offsets need no extra check: the
UnmanagedMemoryStream over the mapping already validates them against the
view length.

Assisted-by: Claude:claude-fable-5:Claude Code

3 weeks ago

2 Commits (fix/lambda-parameter-syntax)