FastSerializationObjectParser.ReadBlockHeader read an attacker-controlled
32-bit type-name length from fully untrusted nettrace/EventPipe input and only
validated the upper bound (typeLen > maxLen). A negative length passed that
check and flowed into 'stackalloc byte[typeLen]', where the count is converted
to an enormous unsigned size, reliably crashing the process with an uncatchable
StackOverflowException (a denial of service on malformed input). This was found
by the TraceEvent nettrace fuzzer, which reproduces it with a 693-byte input.

Reject negative type-name lengths alongside oversized ones, and add a
regression test that asserts a FormatException (not a crash) for a negative
object type length.


Copilot-Session: 7c1dc14b-deed-412d-bdca-a44a5ac9bf9a

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix AccessViolation on malformed MethodILToNativeMap entry count

TraceLog.AddILMapping trusted CountOfMapEntries, a 16-bit count read from fully
untrusted MethodILToNativeMap (EventID 190) event payload, when reading the
ILOffset/NativeOffset entries. Because NativeOffset(i) is indexed relative to
CountOfMapEntries, a corrupt or fuzzed EventPipe/ETW stream that claims more
entries than the payload actually contains caused the reads to index past the
end of the event buffer and access protected memory, crashing the process with
an (uncatchable) AccessViolationException. Found by the TraceEvent nettrace
fuzzer.

Reject events whose payload is too small for the claimed entry count (a valid
event has EventDataLength >= CountOfMapEntries * 8 + 21), record the skip in the
conversion log, and add a regression test that drives the full TraceLog
conversion path with such a malformed event.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7c1dc14b-deed-412d-bdca-a44a5ac9bf9a

* Simplify IL map payload validation

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: b49ece18-cc2c-4ca2-8aff-82c7906a5518

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…itch lines (#2446)

ReadProcessNameUntilNextField loops until it finds the expected next field
name (e.g. prev_pid/next_pid/pid). On malformed or truncated perf script
input where that field name never appears, the loop never terminated,
hanging the parser. OneFuzz fuzzing of the Linux perf script parser found
146 such hang inputs.

Break out of the loop when the end of the stream is reached. Adds a
regression test that parses a truncated sched_switch line and asserts
parsing terminates.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7c1dc14b-deed-412d-bdca-a44a5ac9bf9a

* Support TraceLogging formatting hints

Trace Data Helper lets you add display hints to fields in events. For
example, there are hints to indicate that an integer value should hex
formatted on display or that the value is a HRESULT. The commonly used
[C++ TraceLogging library][0] supports these hints via its [TraceLogging
Wrapper macros][1].

Add support for pretty printing the following _TDH_OUT_TYPE values:

* TDH_OUTTYPE_HEXINT8 - hex, width of the underlying type
* TDH_OUTTYPE_HEXINT16 - hex, width of the underlying type
* TDH_OUTTYPE_HEXINT32 - hex, width of the underlying type
* TDH_OUTTYPE_HEXINT64 - hex, width of the underlying type
* TDH_OUTTYPE_PID - decimal number without digit seperators
* TDH_OUTTYPE_TID - decimal number without digit seperators
* TDH_OUTTYPE_PORT - decimal number without digit seperators, converted
  from network byte order
* TDH_OUTTYPE_IPV4 - dotted quad
* TDH_OUTTYPE_IPV6 - colon-seperated, elision of runs of zeros
* TDH_OUTTYPE_SOCKETADDRESS - "address:port" for AF_INET and AF_INET6
* TDH_OUTTYPE_ERRORCODE - hex, no padding
* TDH_OUTTYPE_WIN32ERROR - hex, no padding
* TDH_OUTTYPE_NTSTATUS - hex, always 8 digits wide
* TDH_OUTTYPE_HRESULT - hex, always 8 digits wide
* TDH_OUTTYPE_CODE_POINTER - lowercase hex, minimum of 8 digits wide

Fixes #2436.

Given TraceLogging code like this:

```
TraceLoggingWrite(
    g_hMyProvider,
    "MyEvent",
    TraceLoggingUInt32(value1ToLog),
    TraceLoggingHexUInt32(value2ToLog));
```

In PerfView today, this would be rendered as

```
    value1ToLog="1" value2ToLog="32,769"
```

Now, it is rendered as

```
    value1ToLog="1" value2ToLog="0x00008001"
```

For things like flags these format hints can make it easier to read
values at a glance. There are also common values that are represented in
hex, like PCI IDs.

When PerfView already had support for formatting a value, its existing
formating style was followed. Otherwise, I matched WPA's formatting.

Changes made:

* Changed TraceEvent's representation of the output type from a ushort
  to the new TdhOutputType enum.
* Add TdhFormtter.cs that knows how to format a value with a given
  formatting hint. A formatting hint was chosen so that the PayloadFetch
  object didn't need to remember both its TdhInputType and its
  TdhOutputType.
* Reved the FastSerializable format to include the new formatting hint.
* Introduced a new FormatUtils helper for shared formatting code between
  TraceEvent.cs and DynamicTraceEventParser.cs
* Unit tests for the new formatting logic added.
* Updated the baseline files to capture the changes in formatting.

[0]: https://learn.microsoft.com/windows/win32/tracelogging/trace-logging-portal
[1]: https://learn.microsoft.com/windows/win32/tracelogging/tracelogging-wrapper-macros

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Improve keyboard focus indicator contrast

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Isolate focus visual WPF tests

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 11232b9e-2a12-482f-88c4-6b9023450660

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 11232b9e-2a12-482f-88c4-6b9023450660

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: bf7bd1f4-f0fd-4d6c-b398-808014b1bbeb

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 41660996-15c9-4feb-904d-eff836f5f59e

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Add Accessible Label To Directory Search Field

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Align Directory Field Accessible Name

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Preserve directory automation name

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 41660996-15c9-4feb-904d-eff836f5f59e

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 41660996-15c9-4feb-904d-eff836f5f59e

* Add support for showing stacks from selected events:

- Before this commit you could only show stacks for either a single time or a time range
- This commit makes selecting any amount of events (no matterer what column of the event) and opening its stack (if there is one) possible
- The stacks shown are now not only filtered by the time but also event id  so no other events that happened at the same time are shown.
- The behavior for selecting a time range remains the same as before

* fix(event-viewer): address selected stacks review feedback

  - Preserve stack opening when no events are selected
  - Snapshot selected cells before background processing
  - Handle non-ETW selections with a single bounded time range
  - Honor stack-source predicates instead of falling back unfiltered
  - Add UI coverage for event selections and time ranges

* Update UsersGuide.htm

* Use net.4.5.2.x86.etl.zip for EventViewer tests.
Remove unused method.
Improve exception message in PerfViewData.cs.

* Fix pipeline block

* • Harden EventWindow tests against hangs and cleanup failures

  Add bounded waits with stage-specific timeout messages, move ETL
  extraction off the UI thread, and guarantee window and trace cleanup.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: acdb67f6-a492-4a25-b979-7072d0d89197

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: acdb67f6-a492-4a25-b979-7072d0d89197

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7779c516-cb26-4d94-a363-349fbb20eaee

* Improve stack names for generated JIT helpers

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>