Protect against circular type forwarders (#806)

* Protect against circular type forwarders

If we have two assemblies with type forwarders that point to each other, we enter an infinite loop and a stack overflow.

This breaks the cycle by detecting reentrancy.

Fixes #706

* Add a test for TypeForwardedTo circularity

* Move field up

Author: KirillOsenkov

Mono.Cecil/ExportedType.cs

@@ -22,6 +22,7 @@ public sealed class ExportedType : IMetadataTokenProvider {
 		int identifier;
 		ExportedType declaring_type;
 		internal MetadataToken token;
+		bool reentrancyGuard;
 
 		public string Namespace {
 			get { return @namespace; }
@@ -227,7 +228,17 @@ public override string ToString ()
 
 		public TypeDefinition Resolve ()
 		{
-			return module.Resolve (CreateReference ());
+			if (reentrancyGuard) {
+				throw new InvalidOperationException ($"Circularity when resolving exported type: '{this}'");
+			}
+
+			reentrancyGuard = true;
+			try {
+				return module.Resolve (CreateReference ());
+			}
+			finally {
+				reentrancyGuard = false;
+			}
 		}
 
 		internal TypeReference CreateReference ()

Test/Mono.Cecil.Tests/ResolveTests.cs

@@ -148,6 +148,23 @@ public void TypeForwarder ()
 			Assert.AreEqual (Platform.OnCoreClr ? "System.Private.CoreLib" : "mscorlib", definition.Module.Assembly.Name.Name);
 		}
 
+		[Test]
+		public void TypeForwarderCircularity ()
+		{
+			var resolver = new CustomResolver();
+			var parameters = new ReaderParameters { AssemblyResolver = resolver };
+			
+			var module1 = GetResourceModule("TypeForwarderLoop1.dll", parameters);
+			var module2 = GetResourceModule("TypeForwarderLoop2.dll", parameters);
+
+			resolver.Register(module1.Assembly);
+			resolver.Register(module2.Assembly);
+
+			var reference = new TypeReference("MyNamespace", "MyType", module1, AssemblyNameReference.Parse(module1.Assembly.FullName), false);
+
+			Assert.Throws<InvalidOperationException>(() => { _ = reference.Resolve(); });
+		}
+
 		[Test]
 		public void NestedTypeForwarder ()
 		{