8006807: C2 crash due to out of bounds array access in Parse::do_multianewarray

Wed, 06 Feb 2013 11:33:49 -0800

author
drchase
date
Wed, 06 Feb 2013 11:33:49 -0800
changeset 4540
4fcf990aa34a
parent 4539
6a51fc70a15e
child 4541
d05ff4bf41b3

8006807: C2 crash due to out of bounds array access in Parse::do_multianewarray
Summary: check ndimensions before accessing length[i] element
Reviewed-by: kvn
Contributed-by: volker.simonis@gmail.com

src/share/vm/opto/parse3.cpp file | annotate | diff | comparison | revisions
     1.1 --- a/src/share/vm/opto/parse3.cpp	Tue Feb 05 08:25:51 2013 -0800
     1.2 +++ b/src/share/vm/opto/parse3.cpp	Wed Feb 06 11:33:49 2013 -0800
     1.3 @@ -1,5 +1,5 @@
     1.4  /*
     1.5 - * Copyright (c) 1998, 2012, Oracle and/or its affiliates. All rights reserved.
     1.6 + * Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved.
     1.7   * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
     1.8   *
     1.9   * This code is free software; you can redistribute it and/or modify it
    1.10 @@ -487,7 +487,8 @@
    1.11                            fun, NULL, TypeRawPtr::BOTTOM,
    1.12                            makecon(TypeKlassPtr::make(array_klass)),
    1.13                            length[0], length[1], length[2],
    1.14 -                          length[3], length[4]);
    1.15 +                          (ndimensions > 2) ? length[3] : NULL,
    1.16 +                          (ndimensions > 3) ? length[4] : NULL);
    1.17    } else {
    1.18      // Create a java array for dimension sizes
    1.19      Node* dims = NULL;

mercurial