ReVanced/smali
1
0
Fork 0
mirror of https://github.com/revanced/smali.git synced 2025-05-29 04:10:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add some additional checks related to instruction size

Browse Source
This commit is contained in:
Ben Gruver 2014-11-06 19:37:12 -08:00
parent 20d4a3c2b4
commit 686cf35c8e
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
dexlib2/src/main/java/org/jf/dexlib2/dexbacked/DexBackedMethodImplementation.java
View File

@ -41,6 +41,7 @@ import org.jf.dexlib2.iface.MethodImplementation;
import org.jf.dexlib2.iface.debug.DebugItem; import org.jf.dexlib2.iface.debug.DebugItem;
import org.jf.dexlib2.iface.instruction.Instruction; import org.jf.dexlib2.iface.instruction.Instruction;
import org.jf.util.AlignmentUtils; import org.jf.util.AlignmentUtils;
import org.jf.util.ExceptionWithContext;
import javax.annotation.Nonnull; import javax.annotation.Nonnull;
import javax.annotation.Nullable; import javax.annotation.Nullable;
@ -77,7 +78,15 @@ public class DexBackedMethodImplementation implements MethodImplementation {
if (reader.getOffset() >= endOffset) { if (reader.getOffset() >= endOffset) {
return null; return null;
} }
return DexBackedInstruction.readFrom(reader);
Instruction instruction = DexBackedInstruction.readFrom(reader);
// Does the instruction extend past the end of the method?
int offset = reader.getOffset();
if (offset > endOffset || offset < 0) {
throw new ExceptionWithContext("The last instruction in the method is truncated");
}
return instruction;
} }
}; };
} }

3
dexlib2/src/main/java/org/jf/dexlib2/dexbacked/instruction/DexBackedArrayPayload.java
View File

@ -56,6 +56,9 @@ public class DexBackedArrayPayload extends DexBackedInstruction implements Array
elementWidth = dexFile.readUshort(instructionStart + ELEMENT_WIDTH_OFFSET); elementWidth = dexFile.readUshort(instructionStart + ELEMENT_WIDTH_OFFSET);
elementCount = dexFile.readSmallUint(instructionStart + ELEMENT_COUNT_OFFSET); elementCount = dexFile.readSmallUint(instructionStart + ELEMENT_COUNT_OFFSET);
if (((long)elementWidth) * elementCount > Integer.MAX_VALUE) {
throw new ExceptionWithContext("Invalid array-payload instruction: element width*count overflows");
}
} }
@Override public int getElementWidth() { return elementWidth; } @Override public int getElementWidth() { return elementWidth; }