ILSpy

9475 Commits

54 Branches

94 Tags

91 MiB

Tree: cd181b3f08

Commit Graph

Author	SHA1	Message	Date
Siegfried Pammer	15719eedd6	Reject negative char index in the length-and-char string switch MatchSwitchOnCharBlock's case 2 and default paths guarded against a negative character index, but case 1 (a bare switch on get_Chars) did not. Crafted IL whose get_Chars/get_Item index is negative - a value no compiler emits, but valid IL - therefore reached the pattern reconstruction unchecked. For a length-1 group this silently miscompiled the switch (it rebuilds the string switch from the char labels without using the index), turning IL that reads s[-1] into `switch (s)`; for longer strings it threw IndexOutOfRangeException and aborted the method. Move the check into MatchGetChars so all three call sites reject a negative index by construction, and drop the two now-redundant guards. Same class of unvalidated-integer robustness issue as #3878, in a different switch-on-string pattern. Assisted-by: Claude:claude-opus-4-8:Claude Code	2 months ago

Author

SHA1

Message

Date

Siegfried Pammer

15719eedd6

Reject negative char index in the length-and-char string switch

MatchSwitchOnCharBlock's case 2 and default paths guarded against a
negative character index, but case 1 (a bare switch on get_Chars) did
not. Crafted IL whose get_Chars/get_Item index is negative - a value no
compiler emits, but valid IL - therefore reached the pattern
reconstruction unchecked. For a length-1 group this silently miscompiled
the switch (it rebuilds the string switch from the char labels without
using the index), turning IL that reads s[-1] into `switch (s)`; for
longer strings it threw IndexOutOfRangeException and aborted the method.

Move the check into MatchGetChars so all three call sites reject a
negative index by construction, and drop the two now-redundant guards.

Same class of unvalidated-integer robustness issue as #3878, in a
different switch-on-string pattern.

Assisted-by: Claude:claude-opus-4-8:Claude Code

2 months ago

1 Commits (cd181b3f08fe310ce56eaacd8aa8ad32c9fcf66f)