Mercurial > hg > graal-jvmci-8
comparison src/share/vm/classfile/verifier.cpp @ 22916:6b65121b3258
7127066: Class verifier accepts an invalid class file
Summary: For *store bytecodes, compare incoming, not outgoing, type state with exception handlers' stack maps.
Reviewed-by: acorn, dholmes
author | hseigel |
---|---|
date | Wed, 25 Mar 2015 08:16:48 -0400 |
parents | 695017a614d5 |
children | dd9cc155639c 0095e54dcaa1 |
comparison
equal
deleted
inserted
replaced
22910:3ca53859c3c7 | 22916:6b65121b3258 |
---|---|
653 stackmap_index, bci, ¤t_frame, &stackmap_table, | 653 stackmap_index, bci, ¤t_frame, &stackmap_table, |
654 no_control_flow, CHECK_VERIFY(this)); | 654 no_control_flow, CHECK_VERIFY(this)); |
655 | 655 |
656 | 656 |
657 bool this_uninit = false; // Set to true when invokespecial <init> initialized 'this' | 657 bool this_uninit = false; // Set to true when invokespecial <init> initialized 'this' |
658 bool verified_exc_handlers = false; | |
658 | 659 |
659 // Merge with the next instruction | 660 // Merge with the next instruction |
660 { | 661 { |
661 u2 index; | 662 u2 index; |
662 int target; | 663 int target; |
682 * if we encounter a wide instruction that modifies an invalid | 683 * if we encounter a wide instruction that modifies an invalid |
683 * opcode (not one of the ones listed above) */ | 684 * opcode (not one of the ones listed above) */ |
684 verify_error(ErrorContext::bad_code(bci), "Bad wide instruction"); | 685 verify_error(ErrorContext::bad_code(bci), "Bad wide instruction"); |
685 return; | 686 return; |
686 } | 687 } |
688 } | |
689 | |
690 // Look for possible jump target in exception handlers and see if it | |
691 // matches current_frame. Do this check here for astore*, dstore*, | |
692 // fstore*, istore*, and lstore* opcodes because they can change the type | |
693 // state by adding a local. JVM Spec says that the incoming type state | |
694 // should be used for this check. So, do the check here before a possible | |
695 // local is added to the type state. | |
696 if (Bytecodes::is_store_into_local(opcode) && bci >= ex_min && bci < ex_max) { | |
697 verify_exception_handler_targets( | |
698 bci, this_uninit, ¤t_frame, &stackmap_table, CHECK_VERIFY(this)); | |
699 verified_exc_handlers = true; | |
687 } | 700 } |
688 | 701 |
689 switch (opcode) { | 702 switch (opcode) { |
690 case Bytecodes::_nop : | 703 case Bytecodes::_nop : |
691 no_control_flow = false; break; | 704 no_control_flow = false; break; |
1660 no_control_flow = false; | 1673 no_control_flow = false; |
1661 return; | 1674 return; |
1662 } // end switch | 1675 } // end switch |
1663 } // end Merge with the next instruction | 1676 } // end Merge with the next instruction |
1664 | 1677 |
1665 // Look for possible jump target in exception handlers and see if it | 1678 // Look for possible jump target in exception handlers and see if it matches |
1666 // matches current_frame | 1679 // current_frame. Don't do this check if it has already been done (for |
1667 if (bci >= ex_min && bci < ex_max) { | 1680 // ([a,d,f,i,l]store* opcodes). This check cannot be done earlier because |
1681 // opcodes, such as invokespecial, may set the this_uninit flag. | |
1682 assert(!(verified_exc_handlers && this_uninit), | |
1683 "Exception handler targets got verified before this_uninit got set"); | |
1684 if (!verified_exc_handlers && bci >= ex_min && bci < ex_max) { | |
1668 verify_exception_handler_targets( | 1685 verify_exception_handler_targets( |
1669 bci, this_uninit, ¤t_frame, &stackmap_table, CHECK_VERIFY(this)); | 1686 bci, this_uninit, ¤t_frame, &stackmap_table, CHECK_VERIFY(this)); |
1670 } | 1687 } |
1671 } // end while | 1688 } // end while |
1672 | 1689 |