Fix StackOverflow on malformed EventPipe object type length

Merged
BR
3mo ago
+39-1

Summary

Fixes an uncatchable StackOverflow (denial of service) on malformed EventPipe/nettrace input in the TraceEvent library.

FastSerializationObjectParser.ReadBlockHeader reads an attacker-controlled 32-bit object type-name length from fully untrusted input and only validated the upper bound (typeLen > maxLen). A negative length passed that check and flowed into stackalloc byte[typeLen], where the count is converted to an enormous unsigned size, reliably crashing the process with a StackOverflowException.

This is reachable by any caller that parses untrusted data (e.g. TraceLog.CreateFromEventPipeDataFile, new EventPipeEventSource(...)).

How it was found

Discovered by the TraceEvent nettrace fuzzer. Reproduces deterministically with a 693-byte input on both .NET 9 and .NET 10.

Fix

  • Reject typeLen < 0 alongside oversized lengths in EventPipeEventSource.cs.
  • Add regression test NegativeObjectTypeLengthThrowsInsteadOfStackOverflow asserting a FormatException (graceful rejection) instead of a crash.

Validation

Regression test passes on net8.0 and net462; the fuzzer crash inputs now return cleanly.