mirror of
https://github.com/icsharpcode/ILSpy.git
synced 2026-10-12 02:15:58 +00:00
Christoph Wille
9b3e33472d
The JSON parser's value/object/array readers are mutually recursive with no depth limit, so input nested tens of thousands of levels deep overflows the stack with an uncatchable StackOverflowException (CWE-674) that kills the process. This is reachable through DotNetCorePathFinder, which parses the .deps.json shipped next to an opened assembly, so a crafted manifest beside a target turns dependency resolution into a clean process kill. Thread a depth counter through the readers and throw a catchable JsonParseException once nesting passes a fixed cap. The cap (64) matches the System.Text.Json default and is far beyond any real dependency graph. Assisted-by: Claude:claude-fable-5:Claude Code