{"record":{"id":"eef4d3a2d100de6d","repo":"dotnet/wpf","slug":"isf-size-is-larger-than-maximum-stream-size","errorCode":null,"errorMessage":"ISF size is larger than maximum stream size","messagePattern":"ISF size is larger than maximum stream size","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/PresentationCore/MS/internal/Ink/InkSerializedFormat/DrawingAttributeSerializer.cs","lineNumber":134,"sourceCode":"            double stylusHeight = DrawingAttributeSerializer.V1PenHeightWhenHeightIsMissing;\n            uint rasterOperation = DrawingAttributeSerializer.RasterOperationDefaultV1;\n            int transparency = DrawingAttributeSerializer.TransparencyDefaultV1;\n            bool widthIsSetInISF = false; //did we find KnownIds.Width?\n            bool heightIsSetInISF = false; //did we find KnownIds.Height?\n\n\n            uint cbTotal = maximumStreamSize;\n            while (maximumStreamSize > 0)\n            {\n                KnownTagCache.KnownTagIndex tag;\n                uint uiTag;\n                // First read the tag\n                uint cb = SerializationHelper.Decode (stream, out uiTag);\n                tag = (KnownTagCache.KnownTagIndex)uiTag;\n\n                if (maximumStreamSize < cb)\n                {\n                    throw new ArgumentException(StrokeCollectionSerializer.ISFDebugMessage(\"ISF size is larger than maximum stream size\"));\n                }\n\n                maximumStreamSize -= cb;\n\n                // Get the guid based on the tag\n                Guid guid = guidList.FindGuid (tag);\n                if (guid == Guid.Empty)\n                {\n                    throw new ArgumentException(StrokeCollectionSerializer.ISFDebugMessage(\"Drawing Attribute tag embedded in ISF stream does not match guid table\"));\n                }\n\n                uint dw = 0;\n\n                if (KnownIds.PenTip == guid)\n                {\n                    cb = SerializationHelper.Decode (stream, out dw);\n                    penTip = (PenTip)dw;\n                    if (!PenTipHelper.IsDefined(penTip))","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/PresentationCore/MS/internal/Ink/InkSerializedFormat/DrawingAttributeSerializer.cs#L116-L152","documentation":"DecodeAsISF validates that each decoded attribute size (cb) fits within the caller-provided maximumStreamSize budget. When the size prefix read from the stream exceeds the remaining allowed size, it throws ArgumentException with the message 'ISF size is larger than maximum stream size'. This protects against malformed or hostile streams claiming huge sizes.","triggerScenarios":"Decoding a DrawingAttributes ISF stream whose first size field (cb) is greater than the maximumStreamSize passed to DecodeAsISF — typically a corrupt, truncated, or maliciously crafted stream.","commonSituations":"Loading ISF from untrusted sources; files truncated in transit; passing a too-small maximumStreamSize when the caller computes the budget incorrectly.","solutions":["Pass the full accurate stream length as maximumStreamSize","Validate the ISF source integrity before decoding","Wrap the decode in try-catch and reject the input as corrupt","Regenerate the ISF from original ink data if available"],"exampleFix":"// before\nDrawingAttributeSerializer.DecodeAsISF(stream, guidList, (uint)stream.Length / 2); // budget too small\n// after\nuint maxSize = (uint)stream.Length;\nDrawingAttributeSerializer.DecodeAsISF(stream, guidList, maxSize);","handlingStrategy":"try-catch","validationCode":"// caller: ensure the budget covers the stream\nuint maxSize = stream.CanSeek ? (uint)stream.Length : uint.MaxValue;","typeGuard":null,"tryCatchPattern":"try { DrawingAttributeSerializer.DecodeAsISF(stream, guidList, maxSize); }\ncatch (ArgumentException) { /* mark input corrupt; reject */ }","preventionTips":["Always pass the actual stream length as maximumStreamSize","Validate file integrity (size, checksum) before decode","Never decode ISF from untrusted sources without limits","Keep stream position at 0 before decoding"],"tags":["wpf","ink","isf","stream","size-limit"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}