ILSpy

9396 Commits

54 Branches

94 Tags

91 MiB

Tree: 55fbd563e2

Commit Graph

Author	SHA1	Message	Date
Christoph Wille	a154a7bbbf	Guard against OOB read when bundle signature is at file start SingleFileBundle.IsBundle scans for the 32-byte bundle signature and reads the 8-byte header offset stored immediately before it. That offset only exists in a genuine bundle, where the signature sits near the end of the file. The scan started at the first byte, so a crafted file with the signature at offset 0..7 made it read before the start of the buffer. On the production path that buffer is a page-aligned memory-mapped view, so the read faults on the preceding unmapped page with an AccessViolationException -- a corrupted-state exception that bypasses the loader's catch and terminates the process merely from opening the file. The bundle probe runs on every opened file, so this needs no user action beyond open. Skip the backward read unless the match is at least sizeof(long) bytes into the buffer. While in the same file, bound ReadManifest's FileCount against the bytes that remain before it pre-sizes the entry array, so a crafted manifest can no longer request a multi-gigabyte allocation. Assisted-by: Claude:claude-opus-4-8:Claude Code	3 months ago

Author

SHA1

Message

Date

Christoph Wille

a154a7bbbf

Guard against OOB read when bundle signature is at file start

SingleFileBundle.IsBundle scans for the 32-byte bundle signature and reads the
8-byte header offset stored immediately before it. That offset only exists in a
genuine bundle, where the signature sits near the end of the file. The scan
started at the first byte, so a crafted file with the signature at offset 0..7
made it read before the start of the buffer. On the production path that buffer
is a page-aligned memory-mapped view, so the read faults on the preceding
unmapped page with an AccessViolationException -- a corrupted-state exception
that bypasses the loader's catch and terminates the process merely from opening
the file. The bundle probe runs on every opened file, so this needs no user
action beyond open.

Skip the backward read unless the match is at least sizeof(long) bytes into the
buffer. While in the same file, bound ReadManifest's FileCount against the bytes
that remain before it pre-sizes the entry array, so a crafted manifest can no
longer request a multi-gigabyte allocation.

Assisted-by: Claude:claude-opus-4-8:Claude Code

3 months ago

1 Commits (55fbd563e20feb39a50b4fde0887e2ea9a48b904)