Skip to content

Constrain GetExport RuntimeInfo dereference to module bounds in dbgshim#5919

Open
tommcdon wants to merge 1 commit into
dotnet:mainfrom
tommcdon:dev/tommcdon/dbgshim-getexport-checkrva
Open

Constrain GetExport RuntimeInfo dereference to module bounds in dbgshim#5919
tommcdon wants to merge 1 commit into
dotnet:mainfrom
tommcdon:dev/tommcdon/dbgshim-getexport-checkrva

Conversation

@tommcdon

@tommcdon tommcdon commented Jul 8, 2026

Copy link
Copy Markdown
Member

GetTargetCLRMetrics dereferenced the DotNetRuntimeInfo export returned by PEDecoder::GetExport without verifying the whole RuntimeInfo struct lies within the module. Add a CheckRva over sizeof(RuntimeInfo) before reading it, matching the existing bounds checks on the engine-metrics path.

GetTargetCLRMetrics dereferenced the DotNetRuntimeInfo export returned by
PEDecoder::GetExport without verifying the whole RuntimeInfo struct lies
within the module. Add a CheckRva over sizeof(RuntimeInfo) before reading
it, matching the existing bounds checks on the engine-metrics path.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@tommcdon tommcdon added this to the 11.0.0 milestone Jul 8, 2026
@tommcdon tommcdon requested a review from hoyosjs July 8, 2026 20:13
@tommcdon tommcdon self-assigned this Jul 8, 2026
@tommcdon tommcdon requested a review from a team as a code owner July 8, 2026 20:13
Copilot AI review requested due to automatic review settings July 8, 2026 20:13

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens dbgshim’s Windows GetTargetCLRMetrics path by ensuring the DotNetRuntimeInfo export (resolved via PEDecoder::GetExport) is not dereferenced unless the full RuntimeInfo struct lies within the module’s bounds, aligning it with the existing export/metrics bounds-checking patterns already used elsewhere in the function.

Changes:

  • Add a PEDecoder::CheckRva(..., sizeof(RuntimeInfo)) guard before casting/dereferencing the RuntimeInfo* returned from the export lookup.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@hoyosjs hoyosjs enabled auto-merge (squash) July 8, 2026 20:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants