From 1cd7d2125c3e41d4ab8b9315b0765b78b920465b Mon Sep 17 00:00:00 2001 From: rameel Date: Mon, 5 Oct 2026 19:57:25 +0500 Subject: [PATCH] Make PathHelper bounds checks explicit Use subtraction-based bounds checks in the AVX2, SSE2, and ARM64 paths to avoid relying on input size limits to prevent integer overflow. Add a Debug.Assert before creating the partial-pattern span to explicitly verify that its length is within the source string. This is a defensive refactoring, not a fix for an existing bug or reachable out-of-bounds memory access. Current callers supply strings, and CoreCLR's string length limit already prevents the original addition from overflowing. The change expresses the bounds requirements locally rather than relying on constraints enforced elsewhere. --- .../Internal/PathHelper.cs | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/Ramstack.FileProviders.Globbing/Internal/PathHelper.cs b/src/Ramstack.FileProviders.Globbing/Internal/PathHelper.cs index 0a9c116..80b1650 100644 --- a/src/Ramstack.FileProviders.Globbing/Internal/PathHelper.cs +++ b/src/Ramstack.FileProviders.Globbing/Internal/PathHelper.cs @@ -110,7 +110,10 @@ private static ReadOnlySpan GetPartialPattern(string pattern, int depth) if (depth < 1 || r.final == length || IsGlobStar(ref s, r.start, r.final)) + { + Debug.Assert(r.final >= 0 && r.final <= pattern.Length); return MemoryMarshal.CreateReadOnlySpan(ref s, r.final); + } } [MethodImpl(MethodImplOptions.AggressiveInlining)] @@ -245,7 +248,7 @@ public PathSegmentIterator() => return (start, _last); } - if (Avx2.IsSupported && (int)_position + Vector256.Count <= length) + if (Avx2.IsSupported && (int)_position <= length - Vector256.Count) { var chunk = LoadVector256(ref source, _position); var slash = Vector256.Create('/'); @@ -265,7 +268,7 @@ public PathSegmentIterator() => if (_mask == 0) _position += Vector256.Count; } - else if (Sse2.IsSupported && !Avx2.IsSupported && (int)_position + Vector128.Count <= length) + else if (Sse2.IsSupported && !Avx2.IsSupported && (int)_position <= length - Vector128.Count) { var chunk = LoadVector128(ref source, _position); var slash = Vector128.Create('/'); @@ -285,7 +288,7 @@ public PathSegmentIterator() => if (_mask == 0) _position += Vector128.Count; } - else if (AdvSimd.Arm64.IsSupported && (int)_position + Vector128.Count <= length) + else if (AdvSimd.Arm64.IsSupported && (int)_position <= length - Vector128.Count) { var chunk = LoadVector128(ref source, _position); var slash = Vector128.Create('/');