You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
In JumpTable.SubStr, if count is set to a large int(for example, Int32.MaxValue), index + count may less than 0, and index + count > x.Length will be false, so new Buffer may allocate a large buffer(max is 2GiB)
publicvirtualvoidSubStr(ExecutionEngineengine,Instructioninstruction){intcount=(int)engine.Pop().GetInteger();if(count<0)thrownew InvalidOperationException($"The value {count} is out of range.");intindex=(int)engine.Pop().GetInteger();if(index<0)thrownew InvalidOperationException($"The value {index} is out of range.");varx= engine.Pop().GetSpan();if(index+count> x.Length)thrownew InvalidOperationException($"The value {count} is out of range.");
Types.Buffer result=new(count,false);
x.Slice(index, count).CopyTo(result.InnerBuffer.Span);
engine.Push(result);}
Describe the bug
In
JumpTable.SubStr
, ifcount
is set to a large int(for example, Int32.MaxValue),index + count
may less than 0, andindex + count > x.Length
will be false, sonew Buffer
may allocate a large buffer(max is 2GiB)To Reproduce
like this:
The text was updated successfully, but these errors were encountered: