Merge pull request #286 from taigacon/master

Fix a critical memory out-of-bounds accessing bug of UnsafeDirectBlitResolver
Cysharp · Mar 2, 2020 · abd5fc5 · abd5fc5
2 parents 3676b7c + 1bfbb22
commit abd5fc5
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/src/MagicOnion.Client.Unity/Assets/Scripts/MagicOnion/UnsafeDirectBlitResolver.cs b/src/MagicOnion.Client.Unity/Assets/Scripts/MagicOnion/UnsafeDirectBlitResolver.cs
@@ -164,7 +164,7 @@ public void Serialize(ref MessagePackWriter writer, T value, MessagePackSerializ
             byte[] rentMemory = ArrayPool<byte>.Shared.Rent(size);
             try
             {
-                var span = rentMemory.AsSpan().Slice(size);
+                var span = rentMemory.AsSpan().Slice(0, size);
                 Unsafe.WriteUnaligned(ref span[0], value);
                 writer.Write(span);
             }

diff --git a/src/MagicOnion/UnsafeDirectBlitResolver.cs b/src/MagicOnion/UnsafeDirectBlitResolver.cs
@@ -164,7 +164,7 @@ public void Serialize(ref MessagePackWriter writer, T value, MessagePackSerializ
             byte[] rentMemory = ArrayPool<byte>.Shared.Rent(size);
             try
             {
-                var span = rentMemory.AsSpan().Slice(size);
+                var span = rentMemory.AsSpan().Slice(0, size);
                 Unsafe.WriteUnaligned(ref span[0], value);
                 writer.Write(span);
             }