# HG changeset patch # User drchase # Date 1360179229 28800 # Node ID 4fcf990aa34afaf00cfdba93ce604307c890c3a6 # Parent 6a51fc70a15e597e178ee756a0a30e1d150636ad 8006807: C2 crash due to out of bounds array access in Parse::do_multianewarray Summary: check ndimensions before accessing length[i] element Reviewed-by: kvn Contributed-by: volker.simonis@gmail.com diff -r 6a51fc70a15e -r 4fcf990aa34a src/share/vm/opto/parse3.cpp --- a/src/share/vm/opto/parse3.cpp Tue Feb 05 08:25:51 2013 -0800 +++ b/src/share/vm/opto/parse3.cpp Wed Feb 06 11:33:49 2013 -0800 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1998, 2012, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -487,7 +487,8 @@ fun, NULL, TypeRawPtr::BOTTOM, makecon(TypeKlassPtr::make(array_klass)), length[0], length[1], length[2], - length[3], length[4]); + (ndimensions > 2) ? length[3] : NULL, + (ndimensions > 3) ? length[4] : NULL); } else { // Create a java array for dimension sizes Node* dims = NULL;