Uh oh!
There was an error while loading. Please reload this page.
Merging internal commits for release/9.0 - #129194
Merged
hoyosjs merged 10 commits intoJun 11, 2026
Merged
Conversation
…rite for ByValTStr Fix NativeAOT possible out-of-bounds write for ByValTStr StringToByValAnsiString truncated the input string based on Unicode character count only, then called PInvokeMarshal.StringToAnsiString which computed the full ANSI/UTF-8 byte count and wrote it all to the fixed-size native buffer. Add an optional maxByteCount parameter to StringToAnsiString. When set, the byte length is clamped before performing the conversion. For ASCII-only strings, this truncates. For non-ASCII, on Unix, this results in an ArgumentException when the buffer is too small for the encoded bytes and on Windows, this truncates. This matches coreclr. 9.0 version of https://dnceng.visualstudio.com/internal/_git/dotnet-runtime/pullrequest/59956 ---- #### AI description (iteration 1) #### PR Classification Bug fix to prevent NativeAOT out-of-bounds writes when marshalling `ByValTStr` strings with bounded buffers. #### PR Summary Fixes NativeAOT ANSI string marshalling to respect `ByValTStr` buffer limits and aligns overflow/truncation behavior with CoreCLR; adds regression tests for Unix UTF-8 overflow and ASCII truncation. - `src/coreclr/nativeaot/System.Private.CoreLib/src/System/Runtime/InteropServices/PInvokeMarshal.cs`: Extend `StringToAnsiString` with `maxByteCount`, clamp bytes written for bounded buffers, and avoid writing a null terminator when `maxByteCount == 0`. - `src/coreclr/nativeaot/System.Private.CoreLib/src/Internal/Runtime/CompilerHelpers/InteropHelpers.cs`: Pass `charCount` as `maxByteCount` for `ByValTStr` interop paths to enforce bounds. - `src/libraries/System.Runtime.InteropServices/tests/.../StructureToPtrTests.cs`: Add `ByValTStr` tests covering Unix multibyte overflow throwing and ASCII long-string truncation/termination. <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Solve symlinks before extraction to avoid possible miscellaneous traversals ---- #### AI description (iteration 1) #### PR Classification Security bug fix to prevent directory traversal attacks when extracting tar archives containing malicious symlinks. #### PR Summary This PR fixes a security vulnerability in tar file extraction by adding symlink resolution logic to detect and prevent directory traversal attacks. The fix ensures that symlinks and files within symlink directories cannot escape the intended extraction directory. - `TarEntry.cs`: Added three new methods (`FilePathEscapesDirectory`, `ResolveSymlink`, `ResolvePhysicalPath`) that walk through path components and resolve symlinks at each step to detect directory traversal attempts - `TarEntry.cs`: Enhanced extraction validation by calling `FilePathEscapesDirectory` on file destination paths and link targets to reject entries that escape the destination directory - `TarFile.ExtractToDirectory.File.Tests.cs`: Added two new test cases to verify protection against simple symlink directory traversal and chained symlink directory traversal attacks <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…-merge-9.0-2026-06-09-1503
Contributor
There was a problem hiding this comment.
Pull request overview
This PR merges internal release/9.0 changes that tighten path-safety during tar extraction (including symlink-chain traversal mitigation), add regression tests for those scenarios, and adjust NativeAOT ANSI fixed-buffer (ByValTStr) string marshalling to better match CoreCLR behavior—along with new interop unit tests validating ByValTStr overflow/truncation.
Changes:
- Harden
TarEntryextraction path validation to detect directory escape via symlink resolution at each path component. - Add
TarFile.ExtractToDirectorytests intended to cover symlink-based directory traversal cases. - Update NativeAOT
StringToAnsiStringto support bounded output buffers and add Marshal ByValTStr regression tests.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| src/libraries/System.Runtime.InteropServices/tests/System.Runtime.InteropServices.UnitTests/System/Runtime/InteropServices/Marshal/StructureToPtrTests.cs | Adds ByValTStr tests for multibyte overflow (Unix) and ASCII truncation behavior. |
| src/libraries/System.Formats.Tar/tests/TarFile/TarFile.ExtractToDirectory.File.Tests.cs | Adds tests for symlink-based traversal rejection during extraction. |
| src/libraries/System.Formats.Tar/src/System/Formats/Tar/TarEntry.cs | Adds symlink-aware escape detection to prevent writing outside the destination directory. |
| src/coreclr/nativeaot/System.Private.CoreLib/src/System/Runtime/InteropServices/PInvokeMarshal.cs | Adds bounded-buffer support to ANSI marshalling and adjusts null-termination behavior. |
| src/coreclr/nativeaot/System.Private.CoreLib/src/Internal/Runtime/CompilerHelpers/InteropHelpers.cs | Uses the new bounded-buffer marshalling path for ByVal ANSI strings. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Jun 10, 2026
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
steveisok
approved these changes
Jun 10, 2026
hoyosjs
enabled auto-merge
June 10, 2026 17:15
This was referenced Jun 10, 2026
svick
commented
Jun 11, 2026
Member
/ba-g known issues only |
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.