6756528: Bytecodes::special_length_at reads past end of code buffer

Add end-of-buffer indicator for paths used by the verifier

Reviewed-by: acorn, coleenp
This commit is contained in:
Keith McGuigan 2008-10-30 15:48:59 -04:00
parent 107bbcc8f4
commit 7de6d649be
3 changed files with 29 additions and 10 deletions

View file

@ -28,8 +28,9 @@
Bytecodes::Code RawBytecodeStream::raw_next_special(Bytecodes::Code code) {
assert(!is_last_bytecode(), "should have been checked");
// set next bytecode position
address bcp = RawBytecodeStream::bcp();
int l = Bytecodes::raw_special_length_at(bcp);
address bcp = RawBytecodeStream::bcp();
address end = method()->code_base() + end_bci();
int l = Bytecodes::raw_special_length_at(bcp, end);
if (l <= 0 || (_bci + l) > _end_bci) {
code = Bytecodes::_illegal;
} else {
@ -39,8 +40,12 @@ Bytecodes::Code RawBytecodeStream::raw_next_special(Bytecodes::Code code) {
_is_wide = false;
// check for special (uncommon) cases
if (code == Bytecodes::_wide) {
code = (Bytecodes::Code)bcp[1];
_is_wide = true;
if (bcp + 1 >= end) {
code = Bytecodes::_illegal;
} else {
code = (Bytecodes::Code)bcp[1];
_is_wide = true;
}
}
}
_code = code;