Handle invalid and oversized MIX file indexes#325
Open
NayiemW wants to merge 1 commit into
Open
Conversation
The MIX header's file count was read as a signed 16-bit value, so archives with more than 32767 entries produced a negative count and silently registered as empty. Read it as unsigned. A zero file count means the index - or its decryption - came out garbage; throw instead of silently registering an empty MIX, and log and skip such archives when loading so a single corrupt MIX file does not crash the editor.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to [36209485](36209485), completing the remaining MIX index hardening.
MIX headers store the number of archive entries as an unsigned 16-bit value. WAE previously read this field using
BitConverter.ToInt16, which interpreted counts above 32,767 as negative numbers.As a result, sufficiently large MIX archives could not be indexed correctly and would silently appear empty. This change reads the field as a
ushort, allowing the full range of valid MIX entry counts.The parser now also rejects indexes with a file count of zero. A zero count generally indicates that the index is invalid—for example, because the archive is truncated or an encrypted index could not be decrypted correctly. Previously, such archives were silently registered as empty, hiding the underlying parsing failure.
Invalid MIX archives now produce a clear parsing exception. During archive discovery, that exception is logged and the affected archive is skipped, allowing the editor to continue loading instead of crashing because of a single corrupt MIX file.
Together, these changes ensure that WAE: