{"record":{"id":"4ab0a5ed22620b9a","repo":"dotnet/wpf","slug":"isf-size-if-greater-then-maximum-stream-size","errorCode":null,"errorMessage":"ISF size if greater then maximum stream size","messagePattern":"ISF size if greater then maximum stream size","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/PresentationCore/MS/internal/Ink/InkSerializedFormat/DrawingAttributeSerializer.cs","lineNumber":218,"sourceCode":"                    cb = SerializationHelper.Decode (stream, out dw);\n                    _size = (double)dw;\n                    maximumStreamSize -= cb;\n                    if (maximumStreamSize > 0)\n                    {\n                        cb = SerializationHelper.Decode (stream, out dw);\n                        maximumStreamSize -= cb;\n                        if (KnownTagCache.KnownTagIndex.Mantissa == (KnownTagCache.KnownTagIndex)dw)\n                        {\n                            uint cbInSize;\n                            // First thing that is in there is maximumStreamSize of the data\n                            cb = SerializationHelper.Decode (stream, out cbInSize);\n                            maximumStreamSize -= cb;\n\n                            // in maximumStreamSize is one more than the decoded no\n                            cbInSize++;\n                            if (cbInSize > maximumStreamSize)\n                            {\n                                throw new ArgumentException(StrokeCollectionSerializer.ISFDebugMessage(\"ISF size if greater then maximum stream size\"));\n                            }\n                            byte[] in_data = new byte[cbInSize];\n\t\t\t\t\t\t\t\n                            uint bytesRead = (uint) stream.Read (in_data, 0, (int)cbInSize);\n                            if (cbInSize != bytesRead)\n                            {\n                                throw new ArgumentException(StrokeCollectionSerializer.ISFDebugMessage(\"Read different size from stream then expected\"));\n                            }\n\n                            byte[] out_buffer = Compressor.DecompressPropertyData (in_data);\n                            using (MemoryStream localStream = new MemoryStream(out_buffer))\n                            using (BinaryReader rdr = new BinaryReader(localStream))\n                            {\n                                short sFraction = rdr.ReadInt16();\n                                _size += (double)(sFraction / DrawingAttributes.StylusPrecision);\n\n                                maximumStreamSize -= cbInSize;\n\t\t\t                }","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/PresentationCore/MS/internal/Ink/InkSerializedFormat/DrawingAttributeSerializer.cs#L200-L236","documentation":"For variable-size attribute payloads, DecodeAsISF reads a length prefix (adds one via cbInSize++), then checks that the resulting payload size still fits within the remaining maximumStreamSize. If cbInSize exceeds it, ArgumentException with 'ISF size if greater then maximum stream size' is thrown, protecting against oversized/corrupt size fields.","triggerScenarios":"Decoding ISF where a size prefix (plus one byte) exceeds the remaining maximumStreamSize — truncated files, malicious streams with inflated lengths, or a caller-supplied maximumStreamSize smaller than the real data.","commonSituations":"Untrusted ISF input (fuzzing/malware analysis); files damaged in transfer; incorrectly computed stream budgets in calling code.","solutions":["Pass the true full stream length as maximumStreamSize","Validate stream integrity/length before decoding","Try-catch the decode and treat failure as corrupt input","Regenerate the ISF from the original ink source"],"exampleFix":"// before\nuint budget = 1024; // arbitrary\nDrawingAttributeSerializer.DecodeAsISF(stream, guidList, budget);\n// after\nuint budget = (uint)stream.Length; // real stream size\nDrawingAttributeSerializer.DecodeAsISF(stream, guidList, budget);","handlingStrategy":"try-catch","validationCode":"// pre-check budget\nif (!stream.CanSeek || stream.Length == 0) throw new InvalidDataException(\"empty or non-seekable ISF stream\");","typeGuard":null,"tryCatchPattern":"try { DrawingAttributeSerializer.DecodeAsISF(stream, guidList, maxSize); }\ncatch (ArgumentException) { /* treat stream as corrupt; reject or quarantine */ }","preventionTips":["Pass the real stream length as maximumStreamSize","Checksum and length-validate ISF before decoding","Fuzz-test your ISF loading path with malformed inputs","Regenerate ISF rather than attempting byte-level repairs"],"tags":["wpf","ink","isf","stream","size-limit"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}