Fix integer overflow infinite loop in WriteStateInfoBase.EnsureSpaceInBuffer

[Copilot]

EnsureSpaceInBuffer doubled the buffer size using an int, which could overflow to a negative value for buffers approaching ~1GB, turning the growth loop's termination condition (positive >= negative) permanently true and hanging the thread.

Changes

• Compute the doubled size using a long accumulator so the loop condition remains correct regardless of how large the buffer grows.
• Cast back to int (via checked) only when allocating the new buffer, so an actual out-of-range allocation still fails fast with an OverflowException instead of silently wrapping.

private void EnsureSpaceInBuffer(int moreBytes)
{
    long newsize = Buffer.Length;
    while (_currentBufferUsed + moreBytes >= newsize)
    {
        newsize *= 2;
    }

    if (newsize > Buffer.Length)
    {
        byte[] tempBuffer = new byte[checked((int)newsize)];
        _buffer.CopyTo(tempBuffer, 0);
        _buffer = tempBuffer;
    }
}

• Fixes WriteStateInfoBase.EnsureSpaceInBuffer infinite loop via integer overflow #131823

[Copilot]

Copilot wasn't able to review any files in this pull request.

[azure-pipelines]

Azure Pipelines:
16 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/libraries/System.Net.Mail/src/System/Net/Mime/WriteStateInfoBase.cs:61

• _currentBufferUsed + moreBytes is still evaluated as int, so it can overflow before the comparison (breaking the resizing logic), and the long-based doubling can overshoot past int/Array.MaxLength and then fail the allocation cast even when the required size would fit. Consider computing the required size in long, clamping growth to Array.MaxLength, and keeping the final allocation size as an int that is guaranteed to be > required and <= Array.MaxLength (also handle the edge case of a 0-length buffer, which would otherwise loop forever).

            long newsize = Buffer.Length;
            while (_currentBufferUsed + moreBytes >= newsize)
            {
                newsize *= 2;
            }

src/libraries/System.Net.Mail/src/System/Net/Mime/WriteStateInfoBase.cs:58

• This change targets an extreme-size overflow/infinite-loop scenario, but the existing unit tests only cover small-buffer growth. Adding a targeted test for the overflow/near-Array.MaxLength behavior would help prevent regressions; since this code is hard to exercise without huge allocations, consider factoring the growth calculation into a small internal helper that can be unit-tested with large numeric inputs.

        private void EnsureSpaceInBuffer(int moreBytes)
        {
            long newsize = Buffer.Length;
            while (_currentBufferUsed + moreBytes >= newsize)

[dotnet-policy-service]

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.