[release/10.0] Fix TypeLoadException in GetMarshalAs when SafeArray has zero-length user-defined type name

[AaronRobinsonMSFT]

Backport of #124408 to release/10.0

Customer Impact

• Customer reported
• Found internally

Customer reported in #124346. Getting the CustomAttributes of a ParameterInfo throws TypeLoadException when consuming tlbimp-generated COM interop assemblies (e.g. the Interop.MFilesAPI NuGet package).

A backport to .NET 10.0 was requested in #129889. This is already fixed in .NET 11.

MetadataImport.GetMarshalAs returned raw byte pointers to managed code without associated lengths. When a MarshalAs blob contains NATIVE_TYPE_SAFEARRAY with a zero-length user-defined type name (common in tlbimp-generated COM interop assemblies), the managed side used CreateReadOnlySpanFromNullTerminated to read these pointers, but the strings in the metadata blob are length-prefixed and NOT null-terminated, so this read garbage memory, producing a garbled string that failed type resolution with TypeLoadException.

The fix passes string byte counts alongside the raw pointers, converts GetMarshalAs from an FCALL to a QCall, removes overly strict asserts that forbade trailing bytes (which ECMA-335 permits and tlbimp produces), and adds a regression test.

Fixes #124346
Fixes #129889

Regression

• Yes
• No

Regression from commit a3dc133 (.NET 9), which switched GetMarshalAs from returning managed strings to returning raw byte pointers.

Testing

Automated regression test added (MarshalAsAttributeTests.cs) that builds a PE via PersistedAssemblyBuilder with a FieldMarshal blob reproducing the dangling pointer read.

Risk

Low. Scoped to metadata blob parsing in GetMarshalAs; the bounded-span reads and assert removals only affect the SAFEARRAY/CUSTOMMARSHALER decoding paths, and the change is covered by a new regression test.

[Copilot]

Pull request overview

This PR backports the .NET 11 fix for a .NET 9/10 regression where MetadataImport.GetMarshalAs could mis-read length-prefixed metadata strings as null-terminated, producing garbage type names and throwing TypeLoadException when reflecting MarshalAs data (notably for SAFEARRAY blobs with a zero-length UDT name from tlbimp-generated COM interop assemblies).

Changes:

• Convert GetMarshalAs from an FCALL to a QCall and include explicit UTF-8 byte lengths for returned string pointers.
• Use bounded span decoding on the managed side (no null-terminated reads) and align SAFEARRAY UDT type resolution behavior with existing “best-effort” patterns.
• Relax overly strict native asserts that rejected valid trailing bytes in FieldMarshal blobs, and add a regression test that reproduces the original failure mode deterministically.

Show a summary per file

File	Description
src/libraries/System.Runtime.InteropServices/tests/System.Runtime.InteropServices.UnitTests/System/Runtime/InteropServices/MarshalAsAttributeTests.cs	Adds a regression test PE that reproduces the zero-length SAFEARRAY UDT-name scenario and verifies no TypeLoadException is thrown.
src/coreclr/vm/qcallentrypoints.cpp	Registers the new MetadataImport_GetMarshalAs QCall entrypoint.
src/coreclr/vm/mlinfo.cpp	Removes exact-length debug asserts that incorrectly disallowed trailing bytes in SAFEARRAY/CUSTOMMARSHALER FieldMarshal blobs.
src/coreclr/vm/managedmdimport.hpp	Moves GetMarshalAs to an extern "C" QCall and adds out-parameters for string byte lengths.
src/coreclr/vm/managedmdimport.cpp	Implements the QCall version of GetMarshalAs, populating both pointers and byte counts.
src/coreclr/System.Private.CoreLib/src/System/Reflection/MdImport.cs	Switches to LibraryImport QCall and decodes returned strings using explicit lengths (bounded spans), avoiding null-terminated reads.

Copilot's findings

• Files reviewed: 7/7 changed files
• Comments generated: 0

[AaronRobinsonMSFT]

@steveisok @JulieLeeMSFT Failures are unrelated. This PR is green.

[steveisok]

/ba-g Unrelated issue