Content input boundaries and hostile-input behaviour

CNA snapshot 009d40f5  ·  Deep Dives › Content  ·  source links pinned to 009d40f5

Loading content means trusting lengths, counts, recursion, compression, paths and decoders that come from a file, and then allocating GPU and audio resources on the strength of them. This page collects, across XNB, CNB, CNJ and the build-time XNB importer, where CNA enforces each bound at this snapshot, which trust rule applies to which kind of path, how the loaders are fuzzed and compared against independent implementations, which exceptions a hostile file can produce, and which asymmetries remain. It is written for games that load mods or downloads and for maintainers who change a reader; it states the enforcement points and the gaps without turning either into a blanket claim of safety.

Limits are useful only where they are enforced

A named limit is a guarantee only at the sites that check it. The table compares the four input routes.

The first row is the canonical warning against reading a constant's name as a guarantee. XnbReadLimits::maxFileSize sounds like a file-admission guard, but on the run-time path it bounds only the compressed payload, after TryReadAssetBytes has already read the whole file, so an uncompressed .xnb between 64 MiB and 2 GiB is read and parsed; the content manifest scan reads a file of any size. The build-time importer is the route where the 64 MiB limit is a real admission check. Per-limit enforcement sites for XNB are listed on The XNB container and object graph, the CNB limits on CNB Format.

Decompression output

The two XNB decompressors differ in when they stop. The LZ4 decoder allocates exactly the declared size and refuses any literal or match that would pass it. The LZX loop in XnbDecompression.cpp checks the declared size (at most 256 MiB) before it starts and compares the produced length with it once, after the last block; each block adds at most one window's worth of output, and nothing in the loop stops a stream whose blocks produce more than it declared. That was read from the loop, not exercised. CNB's Zstandard chunks are checked against their declared logical size and the aggregate budget before any allocation and must expand exactly.

Top-level names and internal references have different trust rules

ContentManager::Load<T> deliberately accepts an absolute name, and RootDirectory is a base, not a sandbox: a caller that passes an untrusted name is responsible for validating it. Containment applies instead to paths written inside content: CNJ sourceFile values and sidecar fields, XNB external references, XNB Song and Video media names, and CNB external-reference names. Each family's base directory and refusals are tabulated on ContentManager resolution rules. The shared primitives in PathContainment.hpp compare paths component by component after optional weakly_canonical, never by string prefix, so content-evil is not inside content. One rule is easy to miss: a referring file lexically inside the content root is confined to that root, while a file loaded through an explicit outside-root path is confined to its own folder, which keeps external bundles loadable without letting their embedded paths roam.

ContentPathContainmentTests.cpp (18 cases) covers deep traversal, absolute and drive paths, Unicode-shaped traversal and existing-symlink escapes for Song and Video XNB media, Texture3D, Effect, AnimationClip, Model and skinned-model sidecars, and asserts that each refusal happens before the file is created or read and does not poison the cache. It also pins what stays legal: . segments, repeated separators and .. that normalises back inside the root (ModelNormalizedInRootBinaryFieldsStillLoad, ExplicitExternalSongXnbRemainsConfinedAndLoadable). Symlink checking is not claimed to be race-proof: canonicalisation is followed later by an ordinary open, a time-of-check to time-of-use window. The accurate statement is that escapes present in the filesystem state being checked are refused, not that a concurrently changing filesystem cannot slip one past.

Recursion: two axes bounded, two open

• Type names. Canonical reader names nest generic arguments; XnbTypeName::ParseOne is bounded at 256 levels. At about four bytes per level, a sub-megabyte name exhausted the stack before the bound was added.
• Typed objects. Nested ReadObject<T> dispatch is bounded at 256 by an RAII guard that decrements on success and on every exception, so one failed nested read cannot use up the session's remaining depth.
• Untyped objects. InnerReadObjectAny, which reads object-typed values (Model tags, Dictionary<String, Object> values), shared resources and the untyped root, does not consult that guard. By reading, a file that nests object-typed dictionaries inside each other recurses without the 256 bound; this was not exercised.
• CNJ documents. The JSON parser recurses per array and object with no depth counter, so deeply nested brackets exhaust the stack rather than being refused.

Shared resources use a separate two-pass discipline: counts and indices are validated before any fixup is queued, every shared object is read before any fixup runs, and identity survives forward references. Recursion through the manager is a third kind: no load is marked as in progress, so a reference chain that leads back to its own asset re-enters Load without a cycle check; only CNJ sourceFile refuses cycles explicitly.

Fuzzing reaches the public loaders

The fuzz targets are ordinary GoogleTest cases with fixed seeds, so every run mutates the same way and a failure reproduces:

These targets found defects that review did not: the device-dimension check in the Texture2D reader was added after the container fuzzer produced real process crashes, stack smashing under Vulkan and a non-catchable WebGPU panic, as the comment in Texture2DContentTypeReader.cpp records; neither API's own validation caught them. The build offers CNA_SANITIZE for address and undefined-behaviour sanitizer builds. Coverage is not universal: there is no CNJ document fuzzer, and glTF relies on cgltf's parser plus CNA's container validation (ValidateGltfEXT, which now calls cgltf_validate and checks alignment and required extensions) and conformance tests rather than a mutation fuzzer. CNA's integration record of 9 August 2026 lists a low-severity misaligned read in the vendored cgltf sparse-accessor path as an accepted residual (REMED-CONTENT-010, a duplicate of REMED-NA-016). A later change (plan item GLTF-036, 12 August) root-caused it as a malformed file that CNA accepted: ValidateGltfEXT now refuses, before cgltf_validate runs, a base accessor, sparse index or value view whose offset is not a multiple of its component size and a byteStride that is not a multiple of 4 (GltfContainerValidation.AMisalignedSparseValuesArrayIsRejected and its neighbours), so a file that passes CNA's validation no longer reaches that load. The vendored header is deliberately left unpatched. The residual record itself and the sanitizer results are CNA's own and were read, not re-run, here.

Differential oracles reduce self-consistency risk

A writer and a reader that share one wrong assumption agree with each other, so the strongest evidence comes from outside CNA's own code:

• the LZX decoder is compared byte for byte with FNA's unmodified C# decoder run under Mono, on a single-block and a multi-block payload;
• reader fixtures come from other producers: MonoGame's content pipeline, genuine XNA Game Studio 4.0 output and an LZ4 block made with upstream liblz4;
• transcoding is checked by loading the original XNB and the CNB built from it and comparing the runtime objects (identical pixels, equivalent font, sound and model semantics);
• readers check their own inputs against independent expectations: every texture level's byte count against the block-rounded size its format requires, and a SoundEffect's decoded length against the duration the file stores.

Each oracle has a stated scope. Duration agreement cannot prove waveform identity, a storage round trip cannot prove shader sampling, and a MonoGame-produced fixture proves the layouts MonoGame writes, not every layout XNA could. The per-reader evidence is on XNB type readers.

Error normalisation and its limits

The XNB container fuzzer is also the most precise statement of which exceptions a malformed .xnb may produce through Load<T>, because anything outside its list fails the test:

The CNB fuzzer is stricter and accepts only ContentLoadException from the container and codecs. On the loose tier the manager wraps any std::exception from a reader in ContentLoadException with the original as its cause; that is why a malformed .gltf loaded through Load<Model> now reaches the caller as ContentLoadException even though the glTF import core itself throws std::runtime_error, and why a game's RegisterCnjLoader factory failures are normalised too. Two paths stay unwrapped: the loose tier of Load<SoundEffect>, and exceptions thrown by the object constructors that XNB readers and CNB loaders call. A caller that must survive hostile content catches std::exception as well as ContentLoadException; the tier-by-tier list is on ContentManager resolution rules.

Asymmetries that remain at this snapshot

• The run-time whole-file read of an .xnb is capped only at INT32_MAX, not by maxFileSize.
• LZX output is compared with the declared size only after the last block (by reading).
• The untyped object path is not depth-counted (by reading).
• CNJ has no document-size or nesting limit, still reads Model, custom-GLSL Effect and skinned-model fields with substring scanners, and has no fuzzer.
• The untyped external-reference decoder refuses LZ4 and lacks the typed decoder's 14-byte guard for compressed files.
• Texture3D and TextureCube readers leave dimension limits to texture creation, and Model draw ranges, vertex-element offsets and SpriteFont rectangles are trusted.
• Symlink containment is not time-of-check to time-of-use proof.
• A .cnb built from a source is chosen over the source by existence alone; a stale compiled file is not detected.

Several controls that older descriptions of CNA list as missing are enforced at this snapshot: SpriteFont refuses glyph, cropping, character and kerning lists of different lengths; Texture3D and TextureCube levels must have exact byte counts under a cumulative decoded-size budget; Curve key counts are bounded; SoundEffect loop regions are checked against the decoded frame count in 64-bit arithmetic; index-buffer byte counts must be a whole number of indices; and glTF files are validated with cgltf_validate before import. Extending the same observable limits and fuzz discipline to CNJ and to the untyped object path is the remaining work the asymmetries describe.

Evidence and what is not proven

Read at this snapshot from the content sources and tests linked on this page and its neighbours; no test, fuzzer or sanitizer build was run for it. Established by reading only: the late LZX length comparison, the unguarded untyped object path and the absence of a CNJ depth bound (each a reading of the code, not an executed input). The cgltf residual and the fuzzer's historical findings are CNA's own records.