dotnet / dotnet/runtime

Potential unbounded allocation in SizeOfField for ELEMENT_TYPE_ARRAY metadata signatures

Open
#129,417 1 comment 0 reactions 0 assignees View on GitHub
area-ILTools-coreclr needs-further-triage
Dominant language
C#
Stars
18.3k
Forks
5.6k
PR merge metrics
PR metrics pending

Description

### Description ###

While reviewing ILDasm metadata processing code, I noticed a potential issue in SizeOfField when handling ELEMENT_TYPE_ARRAY signatures.

https://github.com/dotnet/runtime/blob/98bfa17c9f3910eec30099b7ac140d8a09df6227/src/coreclr/ildasm/dasm_sz.cpp#L182-L188

`new (nothrow)` is implemented as follows and returns nullptr when memory is low.:

https://github.com/dotnet/runtime/blob/98bfa17c9f3910eec30099b7ac140d8a09df6227/src/coreclr/nativeaot/Bootstrap/stdcppshim.cpp#L13-L16

If new (nothrow) fails due to insufficient memory, lowerBounds becomes nullptr, the subsequent operations (&lowerBounds[rank] and memset) would dereference nullptr, causing a crash

### Additional context ###
The .NET Runtime codebase typically includes null checks after new (nothrow) (e.g., `ASSERTE_ALL_BUILDS(result != NULL) pattern`). This appears to be an exception to that practice.

### Question ###
Could you please take a look? Is this a genuine issue, or am I missing some context where allocation failure is handled differently here (e.g., rank is guaranteed to be small, or nothrow behavior is overridden)?

Thank you!

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.