mirror of
https://github.com/icsharpcode/ILSpy.git
synced 2026-10-12 02:15:58 +00:00
Christoph Wille
4980c011b8
A single-file bundle manifest is attacker-controlled. Opening a compressed entry pre-allocated a MemoryStream of the declared decompressed size through an unchecked long-to-int cast, then inflated the whole deflate stream before comparing lengths. A few-byte payload declaring ~2 GB thus forced a ~2 GB allocation up front, sizes at or above 2 GB wrapped to a negative capacity, and a decompression bomb was expanded in full before the mismatch was noticed (CWE-789, CWE-197). Grow the buffer only with bytes the deflate stream actually produces and stop reading one byte past the declared size, which already proves the entry corrupt. Reject declared sizes that cannot fit a single in-memory buffer as invalid bundle data. Entry offsets need no extra check: the UnmanagedMemoryStream over the mapping already validates them against the view length. Assisted-by: Claude:claude-fable-5:Claude Code