Wed, 06 Feb 2013 11:33:49 -0800
8006807: C2 crash due to out of bounds array access in Parse::do_multianewarray
Summary: check ndimensions before accessing length[i] element
Reviewed-by: kvn
Contributed-by: volker.simonis@gmail.com
src/share/vm/opto/parse3.cpp | file | annotate | diff | comparison | revisions |
1.1 --- a/src/share/vm/opto/parse3.cpp Tue Feb 05 08:25:51 2013 -0800 1.2 +++ b/src/share/vm/opto/parse3.cpp Wed Feb 06 11:33:49 2013 -0800 1.3 @@ -1,5 +1,5 @@ 1.4 /* 1.5 - * Copyright (c) 1998, 2012, Oracle and/or its affiliates. All rights reserved. 1.6 + * Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved. 1.7 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 1.8 * 1.9 * This code is free software; you can redistribute it and/or modify it 1.10 @@ -487,7 +487,8 @@ 1.11 fun, NULL, TypeRawPtr::BOTTOM, 1.12 makecon(TypeKlassPtr::make(array_klass)), 1.13 length[0], length[1], length[2], 1.14 - length[3], length[4]); 1.15 + (ndimensions > 2) ? length[3] : NULL, 1.16 + (ndimensions > 3) ? length[4] : NULL); 1.17 } else { 1.18 // Create a java array for dimension sizes 1.19 Node* dims = NULL;