Christoph Wille 3d6a529e58 Bound WebCilFile section access against mapped-view length ...

WebCilFile builds raw native pointers into the memory-mapped view directly
from section-header fields read out of attacker-controlled metadata. Unlike
PEFile.GetSectionData, which delegates to the bounds-checked PEReader, this
hand-rolled path validated nothing: a crafted section header could produce a
SectionData (and hence a BlobReader) pointing far outside the view, an
out-of-bounds read reachable on normal decompilation through method-body and
field-data RVA resolution. The (int)RawDataSize narrowing cast could also
yield a negative length.

Resolve and bounds-check the raw-data range against the view length before
constructing SectionData, widening the arithmetic to long so crafted uint
fields cannot wrap the range check or narrow into an apparently valid length.
Structural parsing in FromFile now reports a crafted or truncated module as
"not a WebCIL file" (null) rather than letting EndOfStreamException,
OverflowException or BadImageFormatException escape the loader.

Assisted-by: Claude:claude-opus-4-8:Claude Code

2026-07-05 21:33:03 +02:00

..

SignatureBlobComparerTests.cs

Add test cases

2026-03-21 20:59:56 +01:00

WebCilFileTests.cs

Bound WebCilFile section access against mapped-view length

2026-07-05 21:33:03 +02:00