mirror of
https://github.com/icsharpcode/ILSpy.git
synced 2026-10-12 02:15:58 +00:00
Christoph Wille
bdb4ffaa56
A .resources file's resource count, type count, name lengths, binary resource lengths and serialized-object lengths all come from the file and were only checked for being non-negative before sizing an allocation. A crafted file can therefore request multi-gigabyte arrays from a few-hundred-byte payload (CWE-789), turning a click on a resource node into an out-of-memory condition. The serialization-format kind was additionally an assert-only check that vanishes in Release builds. Each element of these counts occupies at least one byte in the stream, so a value needing more bytes than remain after the current position cannot be honest. Reject it with the same BadImageFormatException the callers already handle, and promote the format-kind assert into a real check. Assisted-by: Claude:claude-fable-5:Claude Code
