ILSpy

9708 Commits

54 Branches

94 Tags

91 MiB

Tree: ad08d21884

Commit Graph

Author	SHA1	Message	Date
Christoph Wille	9b3e33472d	Cap LightJson parser nesting depth to prevent stack overflow The JSON parser's value/object/array readers are mutually recursive with no depth limit, so input nested tens of thousands of levels deep overflows the stack with an uncatchable StackOverflowException (CWE-674) that kills the process. This is reachable through DotNetCorePathFinder, which parses the .deps.json shipped next to an opened assembly, so a crafted manifest beside a target turns dependency resolution into a clean process kill. Thread a depth counter through the readers and throw a catchable JsonParseException once nesting passes a fixed cap. The cap (64) matches the System.Text.Json default and is far beyond any real dependency graph. Assisted-by: Claude:claude-fable-5:Claude Code	3 weeks ago

Author

SHA1

Message

Date

Christoph Wille

9b3e33472d

Cap LightJson parser nesting depth to prevent stack overflow

The JSON parser's value/object/array readers are mutually recursive with
no depth limit, so input nested tens of thousands of levels deep overflows
the stack with an uncatchable StackOverflowException (CWE-674) that kills
the process. This is reachable through DotNetCorePathFinder, which parses
the .deps.json shipped next to an opened assembly, so a crafted manifest
beside a target turns dependency resolution into a clean process kill.

Thread a depth counter through the readers and throw a catchable
JsonParseException once nesting passes a fixed cap. The cap (64) matches
the System.Text.Json default and is far beyond any real dependency graph.

Assisted-by: Claude:claude-fable-5:Claude Code

3 weeks ago

1 Commits (ad08d21884fc080b6580b2acbe088ee688d21cbd)