diff --git a/src/native/eventpipe/ds-profiler-protocol.c b/src/native/eventpipe/ds-profiler-protocol.c index ea7035eb980c68..e1415e6a92cdb0 100644 --- a/src/native/eventpipe/ds-profiler-protocol.c +++ b/src/native/eventpipe/ds-profiler-protocol.c @@ -70,7 +70,7 @@ attach_profiler_command_try_parse_payload ( !ds_ipc_message_try_parse_value (&buffer_cursor, &buffer_cursor_len, (uint8_t *)&instance->profiler_guid, (uint32_t)ARRAY_SIZE (instance->profiler_guid)) || !ds_ipc_message_try_parse_string_utf16_t (&buffer_cursor, &buffer_cursor_len, &instance->profiler_path) || !ds_ipc_message_try_parse_uint32_t (&buffer_cursor, &buffer_cursor_len, &instance->client_data_len) || - !(buffer_cursor_len <= instance->client_data_len)) + !(buffer_cursor_len >= instance->client_data_len)) ep_raise_error (); instance->client_data = buffer_cursor; diff --git a/src/native/eventpipe/ds-protocol.c b/src/native/eventpipe/ds-protocol.c index 8338c8103a9550..496c438461b10b 100644 --- a/src/native/eventpipe/ds-protocol.c +++ b/src/native/eventpipe/ds-protocol.c @@ -396,7 +396,10 @@ ds_ipc_message_try_parse_value ( EP_ASSERT (buffer != NULL); EP_ASSERT (buffer_len != NULL); EP_ASSERT (value != NULL); - EP_ASSERT ((buffer_len - value_len) <= buffer_len); + EP_ASSERT (*buffer_len >= value_len); + + if (*buffer_len < value_len) + return false; memcpy (value, *buffer, value_len); *buffer = *buffer + value_len;