Wed, 24 May 2017 16:53:58 +0200
8180813: Null pointer dereference of CodeCache::find_blob() result
Summary: Fixed missing null checks on the result of CodeCache::find_blob() found by Parfait.
Reviewed-by: shade, kvn
src/share/vm/code/relocInfo.cpp | file | annotate | diff | comparison | revisions | |
src/share/vm/runtime/sharedRuntime.cpp | file | annotate | diff | comparison | revisions |
1.1 --- a/src/share/vm/code/relocInfo.cpp Mon May 22 09:23:59 2017 +0200 1.2 +++ b/src/share/vm/code/relocInfo.cpp Wed May 24 16:53:58 2017 +0200 1.3 @@ -128,9 +128,9 @@ 1.4 if (nm == NULL && begin != NULL) { 1.5 // allow nmethod to be deduced from beginning address 1.6 CodeBlob* cb = CodeCache::find_blob(begin); 1.7 - nm = cb->as_nmethod_or_null(); 1.8 + nm = (cb != NULL) ? cb->as_nmethod_or_null() : NULL; 1.9 } 1.10 - assert(nm != NULL, "must be able to deduce nmethod from other arguments"); 1.11 + guarantee(nm != NULL, "must be able to deduce nmethod from other arguments"); 1.12 1.13 _code = nm; 1.14 _current = nm->relocation_begin() - 1;
2.1 --- a/src/share/vm/runtime/sharedRuntime.cpp Mon May 22 09:23:59 2017 +0200 2.2 +++ b/src/share/vm/runtime/sharedRuntime.cpp Wed May 24 16:53:58 2017 +0200 2.3 @@ -546,7 +546,7 @@ 2.4 CodeBlob *cb = CodeCache::find_blob(pc); 2.5 2.6 // Should be an nmethod 2.7 - assert( cb && cb->is_nmethod(), "safepoint polling: pc must refer to an nmethod" ); 2.8 + guarantee(cb != NULL && cb->is_nmethod(), "safepoint polling: pc must refer to an nmethod"); 2.9 2.10 // Look up the relocation information 2.11 assert( ((nmethod*)cb)->is_at_poll_or_poll_return(pc), 2.12 @@ -1709,7 +1709,7 @@ 2.13 // ask me how I know this... 2.14 2.15 CodeBlob* cb = CodeCache::find_blob(caller_pc); 2.16 - if (!cb->is_nmethod() || entry_point == moop->get_c2i_entry()) { 2.17 + if (cb == NULL || !cb->is_nmethod() || entry_point == moop->get_c2i_entry()) { 2.18 return; 2.19 } 2.20 2.21 @@ -1760,7 +1760,7 @@ 2.22 if (destination != entry_point) { 2.23 CodeBlob* callee = CodeCache::find_blob(destination); 2.24 // callee == cb seems weird. It means calling interpreter thru stub. 2.25 - if (callee == cb || callee->is_adapter_blob()) { 2.26 + if (callee != NULL && (callee == cb || callee->is_adapter_blob())) { 2.27 // static call or optimized virtual 2.28 if (TraceCallFixup) { 2.29 tty->print("fixup callsite at " INTPTR_FORMAT " to compiled code for", caller_pc);