8180813: Null pointer dereference of CodeCache::find_blob() result

Wed, 24 May 2017 16:53:58 +0200

author
thartmann
date
Wed, 24 May 2017 16:53:58 +0200
changeset 8773
1eaa9a72d705
parent 8772
5c6e2c667464
child 8775
3c3a934f88c2

8180813: Null pointer dereference of CodeCache::find_blob() result
Summary: Fixed missing null checks on the result of CodeCache::find_blob() found by Parfait.
Reviewed-by: shade, kvn

src/share/vm/code/relocInfo.cpp file | annotate | diff | comparison | revisions
src/share/vm/runtime/sharedRuntime.cpp file | annotate | diff | comparison | revisions
     1.1 --- a/src/share/vm/code/relocInfo.cpp	Mon May 22 09:23:59 2017 +0200
     1.2 +++ b/src/share/vm/code/relocInfo.cpp	Wed May 24 16:53:58 2017 +0200
     1.3 @@ -128,9 +128,9 @@
     1.4    if (nm == NULL && begin != NULL) {
     1.5      // allow nmethod to be deduced from beginning address
     1.6      CodeBlob* cb = CodeCache::find_blob(begin);
     1.7 -    nm = cb->as_nmethod_or_null();
     1.8 +    nm = (cb != NULL) ? cb->as_nmethod_or_null() : NULL;
     1.9    }
    1.10 -  assert(nm != NULL, "must be able to deduce nmethod from other arguments");
    1.11 +  guarantee(nm != NULL, "must be able to deduce nmethod from other arguments");
    1.12  
    1.13    _code    = nm;
    1.14    _current = nm->relocation_begin() - 1;
     2.1 --- a/src/share/vm/runtime/sharedRuntime.cpp	Mon May 22 09:23:59 2017 +0200
     2.2 +++ b/src/share/vm/runtime/sharedRuntime.cpp	Wed May 24 16:53:58 2017 +0200
     2.3 @@ -546,7 +546,7 @@
     2.4    CodeBlob *cb = CodeCache::find_blob(pc);
     2.5  
     2.6    // Should be an nmethod
     2.7 -  assert( cb && cb->is_nmethod(), "safepoint polling: pc must refer to an nmethod" );
     2.8 +  guarantee(cb != NULL && cb->is_nmethod(), "safepoint polling: pc must refer to an nmethod");
     2.9  
    2.10    // Look up the relocation information
    2.11    assert( ((nmethod*)cb)->is_at_poll_or_poll_return(pc),
    2.12 @@ -1709,7 +1709,7 @@
    2.13    // ask me how I know this...
    2.14  
    2.15    CodeBlob* cb = CodeCache::find_blob(caller_pc);
    2.16 -  if (!cb->is_nmethod() || entry_point == moop->get_c2i_entry()) {
    2.17 +  if (cb == NULL || !cb->is_nmethod() || entry_point == moop->get_c2i_entry()) {
    2.18      return;
    2.19    }
    2.20  
    2.21 @@ -1760,7 +1760,7 @@
    2.22        if (destination != entry_point) {
    2.23          CodeBlob* callee = CodeCache::find_blob(destination);
    2.24          // callee == cb seems weird. It means calling interpreter thru stub.
    2.25 -        if (callee == cb || callee->is_adapter_blob()) {
    2.26 +        if (callee != NULL && (callee == cb || callee->is_adapter_blob())) {
    2.27            // static call or optimized virtual
    2.28            if (TraceCallFixup) {
    2.29              tty->print("fixup callsite           at " INTPTR_FORMAT " to compiled code for", caller_pc);

mercurial