fix(il2cpp): decode valid shared-suffix string offsets

Preserve bounds, termination and UTF-8 checks; verify CLI and stdio MCP preserve names and selected artifact identity.

Fixes #6808
This commit is contained in:
morluto committed 2026-10-24 00:27:57 +08:00
1 parent fc63fe8682
commit 4c5fae5179
4 files changed
+106 -46

No files matched your search

+3 -9
View File
@@ -341,10 +341,9 @@ const recordCounts = (
};
/**
* Decode NUL-terminated UTF-8 names once each from the strings section. An
* index must start a string, so a shifted section or a pointer into another
* name fails instead of returning a different name, and total decoding stays
* bounded by the section size.
* Decode NUL-terminated UTF-8 names once each from the strings section. Indices
* are byte offsets and may refer to a suffix of another stored name. Bounds,
* termination, UTF-8 validity, and the total decoding budget remain enforced.
*/
const createStringReader = (
bytes: Buffer,
@@ -364,11 +363,6 @@ const createStringReader = (
"invalid-string",
`${label} string index ${index} has no terminated entry inside the ${strings.size}-byte string section`,
);
if (index > 0 && pool[index - 1] !== 0)
throw new Il2cppMetadataFormatFailure(
"invalid-string",
`${label} string index ${index} starts inside another string`,
);
beforeText?.(end - index);
let value: string;
try {