Fix sbyte overflow in TypeName parsing (dotnet#107261)

jtschuster · Sep 17, 2024 · c95fc8a · c95fc8a
1 parent 19b2441
commit c95fc8a
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 4 deletions.
diff --git a/src/libraries/System.Reflection.Metadata/src/System/Reflection/Metadata/TypeNameParser.cs b/src/libraries/System.Reflection.Metadata/src/System/Reflection/Metadata/TypeNameParser.cs
@@ -194,7 +194,7 @@ private TypeNameParser(ReadOnlySpan<char> name, bool throwOnError, TypeNameParse
             {
                 while (TryParseNextDecorator(ref capturedBeforeProcessing, out int parsedModifier))
                 {
-                    result = new(fullName: null, assemblyName, elementOrGenericType: result, rankOrModifier: (sbyte)parsedModifier);
+                    result = new(fullName: null, assemblyName, elementOrGenericType: result, rankOrModifier: parsedModifier);
                 }
             }
 

diff --git a/...raries/System.Reflection.Metadata/src/System/Reflection/Metadata/TypeNameParserHelpers.cs b/...raries/System.Reflection.Metadata/src/System/Reflection/Metadata/TypeNameParserHelpers.cs
@@ -11,9 +11,9 @@ namespace System.Reflection.Metadata
 {
     internal static class TypeNameParserHelpers
     {
-        internal const sbyte SZArray = -1;
-        internal const sbyte Pointer = -2;
-        internal const sbyte ByRef = -3;
+        internal const int SZArray = -1;
+        internal const int Pointer = -2;
+        internal const int ByRef = -3;
         private const char EscapeCharacter = '\\';
 #if NET8_0_OR_GREATER
         private static readonly SearchValues<char> s_endOfFullTypeNameDelimitersSearchValues = SearchValues.Create("[]&*,+\\");

diff --git a/src/libraries/System.Reflection.Metadata/tests/Metadata/TypeNameTests.cs b/src/libraries/System.Reflection.Metadata/tests/Metadata/TypeNameTests.cs
@@ -705,6 +705,18 @@ public void TheNumberAfterBacktickDoesNotEnforceGenericArgCount(string input, st
             Assert.Equal("bool", parsed.GetGenericArguments()[1].Name);
         }
 
+        [Fact]
+        public void ArrayRank_SByteOverflow()
+        {
+            const string Input = "WeDontEnforceAnyMaxArrayRank[,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,]";
+
+            TypeName typeName = TypeName.Parse(Input.AsSpan());
+
+            Assert.Equal(Input, typeName.FullName);
+            Assert.True(typeName.IsArray);
+            Assert.Equal(128, typeName.GetArrayRank());
+        }
+
         [Theory]
         [InlineData(typeof(int))]
         [InlineData(typeof(int?))]