ILSpy

9782 Commits

54 Branches

94 Tags

91 MiB

Branch: ldmembertoken

Commit Graph

Author	SHA1	Message	Date
Christoph Wille	bdb4ffaa56	Bound every .resources length against the remaining stream before allocating A .resources file's resource count, type count, name lengths, binary resource lengths and serialized-object lengths all come from the file and were only checked for being non-negative before sizing an allocation. A crafted file can therefore request multi-gigabyte arrays from a few-hundred-byte payload (CWE-789), turning a click on a resource node into an out-of-memory condition. The serialization-format kind was additionally an assert-only check that vanishes in Release builds. Each element of these counts occupies at least one byte in the stream, so a value needing more bytes than remain after the current position cannot be honest. Reject it with the same BadImageFormatException the callers already handle, and promote the format-kind assert into a real check. Assisted-by: Claude:claude-fable-5:Claude Code	3 weeks ago

Author

SHA1

Message

Date

Christoph Wille

bdb4ffaa56

Bound every .resources length against the remaining stream before allocating

A .resources file's resource count, type count, name lengths, binary
resource lengths and serialized-object lengths all come from the file
and were only checked for being non-negative before sizing an allocation.
A crafted file can therefore request multi-gigabyte arrays from a
few-hundred-byte payload (CWE-789), turning a click on a resource node
into an out-of-memory condition. The serialization-format kind was
additionally an assert-only check that vanishes in Release builds.

Each element of these counts occupies at least one byte in the stream, so
a value needing more bytes than remain after the current position cannot
be honest. Reject it with the same BadImageFormatException the callers
already handle, and promote the format-kind assert into a real check.

Assisted-by: Claude:claude-fable-5:Claude Code

3 weeks ago

1 Commits (ldmembertoken)