Fix buffer overrun in dotnet module.

2026-10-12 02:10:00 +00:00 · 2021-01-05 10:52:15 +01:00
parent e2d0ce5f13
commit 4782d10257
2 changed files with 5 additions and 2 deletions
@@ -865,8 +865,11 @@ void dotnet_parse_tilde_2(
          blob_length = blob_result.length;
          blob_offset += blob_result.size;

-          // Quick sanity check to make sure the blob entry is within bounds.
-          if (blob_offset + blob_length >= pe->data + pe->data_size)
+          // Quick sanity check to make sure the blob entry is within bounds
+          // and its length is at least 3 (2 bytes for the 16 bits prolog and
+          // 1 byte for the string length)
+          if (blob_length < 3 ||
+              blob_offset + blob_length >= pe->data + pe->data_size)
          {
            row_ptr += row_size;
            continue;