Skip to content

Commit

Permalink
Two more locations of INVALID_DEX
Browse files Browse the repository at this point in the history
Summary: As title.

Reviewed By: itang00

Differential Revision: D66967385

fbshipit-source-id: 318ce81048f9b68da109374056bcad2f31d7a27a
  • Loading branch information
agampe authored and facebook-github-bot committed Dec 10, 2024
1 parent 4215d10 commit 3801599
Showing 1 changed file with 8 additions and 4 deletions.
12 changes: 8 additions & 4 deletions libredex/DexLoader.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -273,8 +273,10 @@ void DexLoader::gather_input_stats(dex_stats_t* stats, const dex_header* dh) {
if (class_anno_off) {
const uint32_t* anno_data = m_idx->get_uint_data(class_anno_off);
uint32_t count = *anno_data++;
always_assert(anno_data <= anno_data + count);
always_assert((uint8_t*)(anno_data + count) <= m_idx->end());
always_assert_type_log(anno_data <= anno_data + count, INVALID_DEX,
"Dex overflow");
always_assert_type_log((uint8_t*)(anno_data + count) <= m_idx->end(),
INVALID_DEX, "Dex overflow");
for (uint32_t aidx = 0; aidx < count; ++aidx) {
anno_offsets.insert(anno_data[aidx]);
}
Expand All @@ -294,8 +296,10 @@ void DexLoader::gather_input_stats(dex_stats_t* stats, const dex_header* dh) {
if (xrefoff != 0) {
const uint32_t* annoxref = m_idx->get_uint_data(xrefoff);
uint32_t count = *annoxref++;
always_assert(annoxref < annoxref + count);
always_assert((uint8_t*)(annoxref + count) <= m_idx->end());
always_assert_type_log(annoxref < annoxref + count, INVALID_DEX,
"Dex overflow");
always_assert_type_log((uint8_t*)(annoxref + count) <= m_idx->end(),
INVALID_DEX, "Dex overflow");
for (uint32_t j = 0; j < count; j++) {
uint32_t off = annoxref[j];
anno_offsets.insert(off);
Expand Down

0 comments on commit 3801599

Please sign in to comment.