Don't recurse infinitely.
Fix infinite recursion when parsing a malformed binary, discovered by
clusterfuzz.
Fixes
@@ -634,7 +634,8 @@ static char* get_type_def_or_ref_fullname(
const CLASS_CONTEXT* ctx,
uint32_t coded_index,
GENERIC_PARAMETERS* class_gen_params,
- GENERIC_PARAMETERS* method_gen_params)
+ GENERIC_PARAMETERS* method_gen_params,
+ uint32_t depth) // against loops
{
// first 2 bits define table, index starts with third bit
uint32_t index = coded_index >> 2;
@@ -714,7 +715,7 @@ static char* get_type_def_or_ref_fullname(
// Valid blob
if (blob_res.size)
return parse_signature_type(
- ctx, &sig_data, &sig_len, class_gen_params, NULL, 0);
+ ctx, &sig_data, &sig_len, class_gen_params, NULL, depth);
}
}
return NULL;
@@ -859,7 +860,7 @@ static char* parse_signature_type(
// followed by TypeDefOrRefOrSpecEncoded index
coded_index = read_blob_unsigned(data, len);
return get_type_def_or_ref_fullname(
- ctx, coded_index, class_gen_params, method_gen_params);
+ ctx, coded_index, class_gen_params, method_gen_params, depth + 1);
break;
case TYPE_VAR: // Generic class Var
@@ -1090,7 +1091,7 @@ static void parse_type_parents(
{
// Find the parent class
char* parent = get_type_def_or_ref_fullname(
- ctx, extends, class_gen_params, NULL);
+ ctx, extends, class_gen_params, NULL, 0);
uint32_t base_type_idx = 0;
if (parent)
@@ -1121,7 +1122,7 @@ static void parse_type_parents(
if (row.Class == type_idx)
{
char* inteface = get_type_def_or_ref_fullname(
- ctx, row.Interface, class_gen_params, NULL);
+ ctx, row.Interface, class_gen_params, NULL, 0);
if (inteface)
{
yr_set_string(
