Handle possible array size overflow

janvorli · janvorli · commit 69d1e717cd52 · 2024-06-10T21:02:50.000+02:00
In the StackTraceArray::Allocate
diff --git a/src/coreclr/vm/object.cpp b/src/coreclr/vm/object.cpp
@@ -1484,9 +1484,9 @@ void StackTraceArray::Allocate(size_t size)
     }
     CONTRACTL_END;
 
-    size_t raw_size = size * sizeof(StackTraceElement) + sizeof(ArrayHeader);
+    S_SIZE_T raw_size = S_SIZE_T(size) * S_SIZE_T(sizeof(StackTraceElement)) + S_SIZE_T(sizeof(ArrayHeader));
 
-    if (!FitsIn<DWORD>(raw_size))
+    if (raw_size.IsOverflow() || !FitsIn<DWORD>(raw_size))
     {
         EX_THROW(EEMessageException, (kOverflowException, IDS_EE_ARRAY_DIMENSIONS_EXCEEDED));
     }

Original file line number	Diff line number	Diff line change
`@@ -1484,9 +1484,9 @@ void StackTraceArray::Allocate(size_t size)`
`1484`	`1484`	`}`
`1485`	`1485`	`CONTRACTL_END;`
`1486`	`1486`
`1487`		`- size_t raw_size = size * sizeof(StackTraceElement) + sizeof(ArrayHeader);`
	`1487`	`+ S_SIZE_T raw_size = S_SIZE_T(size) * S_SIZE_T(sizeof(StackTraceElement)) + S_SIZE_T(sizeof(ArrayHeader));`
`1488`	`1488`
`1489`		`- if (!FitsIn<DWORD>(raw_size))`
	`1489`	`+ if (raw_size.IsOverflow() \|\| !FitsIn<DWORD>(raw_size))`
`1490`	`1490`	`{`
`1491`	`1491`	`EX_THROW(EEMessageException, (kOverflowException, IDS_EE_ARRAY_DIMENSIONS_EXCEEDED));`
`1492`	`1492`	`}`