ReVanced/smali
1
0
Fork 0
mirror of https://github.com/revanced/smali.git synced 2025-05-28 20:00:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Gracefully handle malformed array payload instructions with element width=0

Browse Source 
These get handled as if they had element width=1 and element count=0
This commit is contained in:
Ben Gruver 2019-08-23 14:04:40 -07:00
parent 225a00c768
commit bdbea44b98
5 changed files with 94 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
baksmali/src/test/java/org/jf/baksmali/ZeroArrayPayloadWidthTest.java Normal file
View File

@ -0,0 +1,44 @@
/*
* Copyright 2019, Google Inc.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are
* met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above
* copyright notice, this list of conditions and the following disclaimer
* in the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Google Inc. nor the names of its
* contributors may be used to endorse or promote products derived from
* this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
package org.jf.baksmali;
import org.junit.Test;
public class ZeroArrayPayloadWidthTest extends DisassemblyTest {
@Test
public void testZeroArrayPayloadWidthTest() {
// This test uses a manually modified dex file with an array-payload instruction that has an element size of 0,
// and an element count that doesn't fit in an unsigned int.
runTest("ZeroArrayPayloadWidthTest");
}
}

BIN
baksmali/src/test/resources/ZeroArrayPayloadWidthTest/ZeroArrayPayloadWidthTestInput.dex Normal file
View File

Binary file not shown.

15
baksmali/src/test/resources/ZeroArrayPayloadWidthTest/ZeroArrayPayloadWidthTestOutput.smali Normal file
View File

@ -0,0 +1,15 @@
.class public LZeroArrayPayloadWidthTest;
.super Ljava/lang/Object;
# virtual methods
.method public zeroWidth()V
.registers 3
return-void
nop
.array-data 1
.end array-data
.end method

21
dexlib2/src/main/java/org/jf/dexlib2/dexbacked/instruction/DexBackedArrayPayload.java
View File

@ -31,6 +31,7 @@
package org.jf.dexlib2.dexbacked.instruction;
import com.google.common.collect.ImmutableList;
import org.jf.dexlib2.Opcode;
import org.jf.dexlib2.dexbacked.DexBackedDexFile;
import org.jf.dexlib2.dexbacked.util.FixedSizeList;
@ -54,10 +55,18 @@ public class DexBackedArrayPayload extends DexBackedInstruction implements Array
int instructionStart) {
super(dexFile, OPCODE, instructionStart);
elementWidth = dexFile.getDataBuffer().readUshort(instructionStart + ELEMENT_WIDTH_OFFSET);
elementCount = dexFile.getDataBuffer().readSmallUint(instructionStart + ELEMENT_COUNT_OFFSET);
if (((long)elementWidth) * elementCount > Integer.MAX_VALUE) {
throw new ExceptionWithContext("Invalid array-payload instruction: element width*count overflows");
int localElementWidth = dexFile.getDataBuffer().readUshort(instructionStart + ELEMENT_WIDTH_OFFSET);
if (localElementWidth == 0) {
elementWidth = 1;
elementCount = 0;
} else {
elementWidth = localElementWidth;
elementCount = dexFile.getDataBuffer().readSmallUint(instructionStart + ELEMENT_COUNT_OFFSET);
if (((long) elementWidth) * elementCount > Integer.MAX_VALUE) {
throw new ExceptionWithContext("Invalid array-payload instruction: element width*count overflows");
}
}
}
@ -72,6 +81,10 @@ public class DexBackedArrayPayload extends DexBackedInstruction implements Array
@Override public int size() { return elementCount; }
}
if (elementCount == 0) {
return ImmutableList.of();
}
switch (elementWidth) {
case 1:
return new ReturnedList() {

32
dexlib2/src/main/java/org/jf/dexlib2/dexbacked/raw/CodeItem.java
View File

@ -540,22 +540,26 @@ public class CodeItem {
out.indent();
out.annotate(2, "element_width = %d", elementWidth);
out.annotate(4, "size = %d", elements.size());
out.annotate(0, "elements:");
if (elements.size() > 0) {
out.annotate(0, "elements:");
}
out.indent();
for (int i=0; i<elements.size(); i++) {
if (elementWidth == 8) {
long value = elements.get(i).longValue();
if (NumberUtils.isLikelyDouble(value)) {
out.annotate(elementWidth, "element[%d] = %d # %f", i, value, Double.longBitsToDouble(value));
if (elements.size() > 0) {
for (int i = 0; i < elements.size(); i++) {
if (elementWidth == 8) {
long value = elements.get(i).longValue();
if (NumberUtils.isLikelyDouble(value)) {
out.annotate(elementWidth, "element[%d] = %d # %f", i, value, Double.longBitsToDouble(value));
} else {
out.annotate(elementWidth, "element[%d] = %d", i, value);
}
} else {
out.annotate(elementWidth, "element[%d] = %d", i, value);
}
} else {
int value = elements.get(i).intValue();
if (NumberUtils.isLikelyFloat(value)) {
out.annotate(elementWidth, "element[%d] = %d # %f", i, value, Float.intBitsToFloat(value));
} else {
out.annotate(elementWidth, "element[%d] = %d", i, value);
int value = elements.get(i).intValue();
if (NumberUtils.isLikelyFloat(value)) {
out.annotate(elementWidth, "element[%d] = %d # %f", i, value, Float.intBitsToFloat(value));
} else {
out.annotate(elementWidth, "element[%d] = %d", i, value);
}
}
}
}