From 4f84e8f9e9bf4c74cbb2fc083d16ecb4fe0ec501 Mon Sep 17 00:00:00 2001 From: "JesusFreke@JesusFreke.com" Date: Tue, 26 Jan 2010 03:17:42 +0000 Subject: [PATCH] Implemented verification for iget/iget-boolean/iget-byte/iget-char/iget-short git-svn-id: https://smali.googlecode.com/svn/trunk@593 55b6fa8a-2a1e-11de-a435-ffa8d773f76a --- .../dexlib/Code/Analysis/MethodAnalyzer.java | 47 +++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/dexlib/src/main/java/org/jf/dexlib/Code/Analysis/MethodAnalyzer.java b/dexlib/src/main/java/org/jf/dexlib/Code/Analysis/MethodAnalyzer.java index b34360eb..6f9b48aa 100644 --- a/dexlib/src/main/java/org/jf/dexlib/Code/Analysis/MethodAnalyzer.java +++ b/dexlib/src/main/java/org/jf/dexlib/Code/Analysis/MethodAnalyzer.java @@ -528,6 +528,16 @@ public class MethodAnalyzer { return handleAputWide(analyzedInstruction); case APUT_OBJECT: return handleAputObject(analyzedInstruction); + case IGET: + return handle32BitPrimitiveIget(analyzedInstruction, RegisterType.Category.Integer); + case IGET_BOOLEAN: + return handle32BitPrimitiveIget(analyzedInstruction, RegisterType.Category.Boolean); + case IGET_BYTE: + return handle32BitPrimitiveIget(analyzedInstruction, RegisterType.Category.Byte); + case IGET_CHAR: + return handle32BitPrimitiveIget(analyzedInstruction, RegisterType.Category.Char); + case IGET_SHORT: + return handle32BitPrimitiveIget(analyzedInstruction, RegisterType.Category.Short); } assert false; @@ -1696,6 +1706,43 @@ public class MethodAnalyzer { return true; } + private boolean handle32BitPrimitiveIget(AnalyzedInstruction analyzedInstruction, + RegisterType.Category instructionCategory) { + TwoRegisterInstruction instruction = (TwoRegisterInstruction)analyzedInstruction.instruction; + + RegisterType objectRegisterType = analyzedInstruction.getPreInstructionRegisterType(instruction.getRegisterB()); + assert objectRegisterType != null; + if (objectRegisterType.category == RegisterType.Category.Unknown) { + return false; + } + checkRegister(objectRegisterType, ReferenceCategories); + + //TODO: check access + //TODO: allow an uninitialized "this" reference, if the current method is an method + Item referencedItem = ((InstructionWithReference)analyzedInstruction.instruction).getReferencedItem(); + assert referencedItem instanceof FieldIdItem; + FieldIdItem field = (FieldIdItem)referencedItem; + + if (objectRegisterType.category != RegisterType.Category.Null && + !objectRegisterType.type.extendsClass(ClassPath.getClassDef(field.getContainingClass()))) { + throw new ValidationException(String.format("Cannot access field %s through type %s", + field.getFieldString(), objectRegisterType.type.getClassType())); + } + + RegisterType fieldType = RegisterType.getRegisterTypeForTypeIdItem(field.getFieldType()); + + if (!checkArrayFieldAssignment(fieldType.category, instructionCategory)) { + throw new ValidationException(String.format("Cannot use %s with field %s. Incorrect field type " + + "for the instruction.", analyzedInstruction.instruction.opcode.name, + field.getFieldString())); + } + + setDestinationRegisterTypeAndPropagateChanges(analyzedInstruction, + RegisterType.getRegisterType(instructionCategory, null)); + + return true; + } + private static boolean checkArrayFieldAssignment(RegisterType.Category arrayFieldCategory, RegisterType.Category instructionCategory) { if (arrayFieldCategory == instructionCategory) {