Fix AccessViolation on malformed MethodILToNativeMap entry count - #2445
Merged
Brian Robbins (brianrob) merged 2 commits intoJul 22, 2026
Merged
Conversation
TraceLog.AddILMapping trusted CountOfMapEntries, a 16-bit count read from fully untrusted MethodILToNativeMap (EventID 190) event payload, when reading the ILOffset/NativeOffset entries. Because NativeOffset(i) is indexed relative to CountOfMapEntries, a corrupt or fuzzed EventPipe/ETW stream that claims more entries than the payload actually contains caused the reads to index past the end of the event buffer and access protected memory, crashing the process with an (uncatchable) AccessViolationException. Found by the TraceEvent nettrace fuzzer. Reject events whose payload is too small for the claimed entry count (a valid event has EventDataLength >= CountOfMapEntries * 8 + 21), record the skip in the conversion log, and add a regression test that drives the full TraceLog conversion path with such a malformed event. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7c1dc14b-deed-412d-bdca-a44a5ac9bf9a
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b49ece18-cc2c-4ca2-8aff-82c7906a5518
Brian Robbins (brianrob)
marked this pull request as ready for review
July 22, 2026 19:34
| get { return Action; } | ||
| set { Action = (Action<MethodILToNativeMapTraceData>)value; } | ||
| } | ||
| internal override void FixupData() |
There was a problem hiding this comment.
As this is an override, do you need to call the method on base?
Member
Author
There was a problem hiding this comment.
Nope - it's just an empty method body.
Matt Connew (mconnew)
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes an uncatchable AccessViolationException (memory-safety / denial of service) on malformed EventPipe/ETW input in the TraceEvent library.
TraceLog.AddILMappingtrustsCountOfMapEntries— a 16-bit count read from fully untrustedMethodILToNativeMap(EventID 190) event payload — when reading the per-entryILOffset/NativeOffsetvalues. BecauseNativeOffset(i)is indexed relative toCountOfMapEntries, a corrupt or fuzzed stream that claims more entries than the payload actually contains makes the reads index past the end of the event buffer and access protected memory, crashing the process with anAccessViolationException.Reachable by any caller that parses untrusted data (e.g.
TraceLog.CreateFromEventPipeDataFile).How it was found
Discovered by the TraceEvent nettrace fuzzer.
Fix
MethodILToNativeMapevents whose payload is too small for the claimed entry count (a valid event hasEventDataLength >= CountOfMapEntries * 8 + 21), and record the skip in the conversion log.MalformedILToNativeMapEntryCountDoesNotAccessViolationthat drives the fullTraceLogconversion path with such a malformed event and asserts it is rejected (deterministic; fails without the fix).