ILSpy

9529 Commits

54 Branches

94 Tags

91 MiB

Tree: a546eae3ad

Commit Graph

Author	SHA1	Message	Date
Christoph Wille	3d6a529e58	Bound WebCilFile section access against mapped-view length WebCilFile builds raw native pointers into the memory-mapped view directly from section-header fields read out of attacker-controlled metadata. Unlike PEFile.GetSectionData, which delegates to the bounds-checked PEReader, this hand-rolled path validated nothing: a crafted section header could produce a SectionData (and hence a BlobReader) pointing far outside the view, an out-of-bounds read reachable on normal decompilation through method-body and field-data RVA resolution. The (int)RawDataSize narrowing cast could also yield a negative length. Resolve and bounds-check the raw-data range against the view length before constructing SectionData, widening the arithmetic to long so crafted uint fields cannot wrap the range check or narrow into an apparently valid length. Structural parsing in FromFile now reports a crafted or truncated module as "not a WebCIL file" (null) rather than letting EndOfStreamException, OverflowException or BadImageFormatException escape the loader. Assisted-by: Claude:claude-opus-4-8:Claude Code	2 months ago

Author

SHA1

Message

Date

Christoph Wille

3d6a529e58

Bound WebCilFile section access against mapped-view length

WebCilFile builds raw native pointers into the memory-mapped view directly
from section-header fields read out of attacker-controlled metadata. Unlike
PEFile.GetSectionData, which delegates to the bounds-checked PEReader, this
hand-rolled path validated nothing: a crafted section header could produce a
SectionData (and hence a BlobReader) pointing far outside the view, an
out-of-bounds read reachable on normal decompilation through method-body and
field-data RVA resolution. The (int)RawDataSize narrowing cast could also
yield a negative length.

Resolve and bounds-check the raw-data range against the view length before
constructing SectionData, widening the arithmetic to long so crafted uint
fields cannot wrap the range check or narrow into an apparently valid length.
Structural parsing in FromFile now reports a crafted or truncated module as
"not a WebCIL file" (null) rather than letting EndOfStreamException,
OverflowException or BadImageFormatException escape the loader.

Assisted-by: Claude:claude-opus-4-8:Claude Code

2 months ago

1 Commits (a546eae3adc78fa8baf43e3bf9aec73c7a01c2fe)