Edge case: prevent in parameter mutations

... by creating defensive copies of byref-like `in` arguments and ref-
erencing those copies instead of the actual parameters.

Author: stakx

src/Castle.Core/DynamicProxy/Generators/MethodWithInvocationGenerator.cs

@@ -104,7 +104,7 @@ protected override MethodEmitter BuildProxiedMethodBody(MethodEmitter emitter, C
 
 			var argumentsMarshaller = new ArgumentsMarshaller(emitter, MethodToOverride.GetParameters());
 
-			argumentsMarshaller.CopyIn(out var argumentsArray, out var hasByRefArguments, out var hasByRefLikeArguments);
+			argumentsMarshaller.CopyIn(out var argumentsArray, out var hasByRefArguments, out var hasByRefLikeArguments, out var byRefLikeBuffers);
 
 			var ctorArguments = GetCtorArguments(@class, proxiedMethodTokenExpression, argumentsArray, methodInterceptors);
 			ctorArguments = ModifyArguments(@class, ctorArguments);
@@ -141,7 +141,7 @@ protected override MethodEmitter BuildProxiedMethodBody(MethodEmitter emitter, C
 
 				if (hasByRefLikeArguments)
 				{
-					argumentsMarshaller.InvalidateByRefLikeProxies(argumentsArray);
+					argumentsMarshaller.InvalidateByRefLikeProxies(argumentsArray, byRefLikeBuffers);
 				}
 
 				if (returnValueBuffer != null)
@@ -254,13 +254,14 @@ public ArgumentsMarshaller(MethodEmitter method, ParameterInfo[] parameters)
 				this.parameters = parameters;
 			}
 
-			public void CopyIn(out LocalReference argumentsArray, out bool hasByRefArguments, out bool hasByRefLikeArguments)
+			public void CopyIn(out LocalReference argumentsArray, out bool hasByRefArguments, out bool hasByRefLikeArguments, out LocalReference[] byRefLikeBuffers)
 			{
 				var arguments = method.Arguments;
 
 				argumentsArray = method.CodeBuilder.DeclareLocal(typeof(object[]));
 				hasByRefArguments = false;
 				hasByRefLikeArguments = false;
+				byRefLikeBuffers = null;
 
 				method.CodeBuilder.AddStatement(
 					new AssignStatement(
@@ -287,6 +288,18 @@ public void CopyIn(out LocalReference argumentsArray, out bool hasByRefArguments
 					{
 						hasByRefLikeArguments = true;
 
+						if (argument.Type.IsByRef && parameters[i].IsReadOnly)
+						{
+							// For by-reference `in` parameters, we create a defensive local copy of the argument
+							// so that (erroneous) mutations to it performed by any interceptor can't propagate back
+							// to the caller:
+							var buffer = method.CodeBuilder.DeclareLocal(dereferencedArgumentType);
+							method.CodeBuilder.AddStatement(new AssignStatement(buffer, dereferencedArgument));
+							byRefLikeBuffers ??= new LocalReference[n];
+							byRefLikeBuffers[i] = buffer;
+							dereferencedArgument = buffer;
+						}
+
 						// Byref-like values live exclusively on the stack and cannot be boxed to `object`.
 						// Instead of them, we prepare instances of `ByRefLikeReference` wrappers that reference them.
 						var referenceCtor = GetByRefLikeReferenceCtorFor(dereferencedArgumentType);
@@ -336,14 +349,25 @@ public void CopyOut(LocalReference argumentsArray)
 				}
 			}
 
-			public void InvalidateByRefLikeProxies(LocalReference argumentsArray)
+			public void InvalidateByRefLikeProxies(LocalReference argumentsArray, LocalReference[] byRefLikeBuffers)
 			{
 #if FEATURE_BYREFLIKE
 				var arguments = method.Arguments;
 
 				for (int i = 0, n = arguments.Length; i < n; ++i)
 				{
-					var argument = arguments[i];
+					Reference argument = arguments[i];
+
+					if (byRefLikeBuffers?[i] != null)
+					{
+						Debug.Assert(parameters[i].IsByRef && parameters[i].IsReadOnly);
+
+						// We previously created a defensive local copy for this `in` parameter
+						// to prevent any mutations escaping to the caller. Redirect `argument`
+						// to that local copy so the below invalidation won't fail its address check:
+						argument = byRefLikeBuffers[i];
+					}
+
 					var argumentType = argument.Type;
 					var dereferencedArgumentType = argumentType.IsByRef ? argumentType.GetElementType()! : argumentType;