Fix AccessViolation on malformed MethodILToNativeMap entry count

Merged
BR
3mo ago
+101-2

Summary

Fixes an uncatchable AccessViolationException (memory-safety / denial of service) on malformed EventPipe/ETW input in the TraceEvent library.

TraceLog.AddILMapping trusts CountOfMapEntries — a 16-bit count read from fully untrusted MethodILToNativeMap (EventID 190) event payload — when reading the per-entry ILOffset/NativeOffset values. Because NativeOffset(i) is indexed relative to CountOfMapEntries, a corrupt or fuzzed stream that claims more entries than the payload actually contains makes the reads index past the end of the event buffer and access protected memory, crashing the process with an AccessViolationException.

Reachable by any caller that parses untrusted data (e.g. TraceLog.CreateFromEventPipeDataFile).

How it was found

Discovered by the TraceEvent nettrace fuzzer.

Fix

  • Reject MethodILToNativeMap events whose payload is too small for the claimed entry count (a valid event has EventDataLength >= CountOfMapEntries * 8 + 21), and record the skip in the conversion log.
  • Add regression test MalformedILToNativeMapEntryCountDoesNotAccessViolation that drives the full TraceLog conversion path with such a malformed event and asserts it is rejected (deterministic; fails without the fix).