pimhwang/ILSpy - ILSpy - git.quantfans.net

Author	SHA1	Message	Date
Siegfried Pammer	4d42b38af1	Handle truncated XALZ input via EndOfStreamException, not length checks Pre-checking stream.Length before reading is racy (the stream can shrink between check and read) and not every stream knows its length ahead of time. Instead, catch EndOfStreamException at each read: a stream too short for the magic is passed through as not-XALZ, and a truncated header or payload after a confirmed magic is rejected as InvalidDataException. stream.Length remains only a sizing hint for the payload buffer. Assisted-by: Claude:claude-fable-5:Claude Code	1 day ago
Christoph Wille	c685d5305b	Bound XamarinCompressedFileLoader against crafted XALZ headers The Xamarin XALZ loader sized its buffer allocations from an attacker-controlled header field and ignored the partial-read length, so merely opening a crafted file (the loader is registered first and runs on any XALZ-magic input) could crash or over-allocate. The declared uncompressed length, a raw header uint cast to int, had no sanity bound: a tiny file claiming ~2 GB forced a giant ArrayPool.Rent (decompression-bomb amplification), and a high-bit value became negative and made Rent throw ArgumentOutOfRangeException. The compressed length was taken as the whole file (header included) and ReadAsync's return value was discarded, leaving stale pooled bytes in the tail fed to the decoder; the output MemoryStream then exposed the entire rented buffer, so PEFile parsed past the real decompressed data into leftover pool contents. Bound the declared length before renting (reject zero, > int.MaxValue, or more than an LZ4 block could expand from this payload at its 255x maximum ratio), read the payload that actually follows the header with ReadExactlyAsync, and slice the output to the length LZ4Codec.Decode reports. Malformed input now fails as a catchable InvalidDataException, consistent with the bundle and .rsrc hardening; well-formed Xamarin modules load exactly as before. Assisted-by: Claude:claude-opus-4-8:Claude Code	1 day ago
Peter Crabtree	e1e16b64f5	dev: Strip BOM mark from text files	10 months ago
Siegfried Pammer	476e80b190	Use uncompressedStream for PEFile in XamarinCompressedFileLoader	2 years ago
Siegfried Pammer	77b237d5a4	Fix mysteriously deleted issue #3197 : Skip file formats that currently can only be loaded from a file when dealing with a file from a bundle or package.	2 years ago
Siegfried Pammer	65e30c0bd6	Add IFileLoader API	2 years ago