diff --git a/src/java.base/share/classes/jdk/internal/classfile/impl/AbstractInstruction.java b/src/java.base/share/classes/jdk/internal/classfile/impl/AbstractInstruction.java index 48e1f0990b2ee..23bf3769608fd 100644 --- a/src/java.base/share/classes/jdk/internal/classfile/impl/AbstractInstruction.java +++ b/src/java.base/share/classes/jdk/internal/classfile/impl/AbstractInstruction.java @@ -317,7 +317,7 @@ static int size(CodeImpl code, int codeStart, int pos) { int pad = ap - (pos + 1); int low = code.classReader.readInt(ap + 4); int high = code.classReader.readInt(ap + 8); - if (high < low || high - low > code.codeLength >> 2) { + if (high < low || (long)high - low > code.codeLength >> 2) { throw new IllegalArgumentException("Invalid tableswitch values low: " + low + " high: " + high); } int cnt = high - low + 1; diff --git a/test/jdk/jdk/classfile/LimitsTest.java b/test/jdk/jdk/classfile/LimitsTest.java index 442707ecd1700..b1914e6d02408 100644 --- a/test/jdk/jdk/classfile/LimitsTest.java +++ b/test/jdk/jdk/classfile/LimitsTest.java @@ -23,7 +23,7 @@ /* * @test - * @bug 8320360 8330684 8331320 8331655 8331940 8332486 8335820 + * @bug 8320360 8330684 8331320 8331655 8331940 8332486 8335820 8336833 * @summary Testing ClassFile limits. * @run junit LimitsTest */ @@ -168,6 +168,28 @@ public void writeBody(BufWriter b) { b.writeU2(0);//exception handlers b.writeU2(0);//attributes }})))).methods().get(0).code().get().elementList()); + assertThrows(IllegalArgumentException.class, () -> + ClassFile.of().parse(ClassFile.of().build(ClassDesc.of("TableSwitchClass"), cb -> cb.withMethod( + "tableSwitchMethod", MethodTypeDesc.of(ConstantDescs.CD_void), 0, mb -> + ((DirectMethodBuilder)mb).writeAttribute(new UnboundAttribute.AdHocAttribute(Attributes.code()) { + @Override + public void writeBody(BufWriter b) { + b.writeU2(-1);//max stack + b.writeU2(-1);//max locals + b.writeInt(20); + b.writeU1(Opcode.NOP.bytecode()); + b.writeU1(Opcode.NOP.bytecode()); + b.writeU1(Opcode.NOP.bytecode()); + b.writeU1(Opcode.NOP.bytecode()); + b.writeU1(Opcode.TABLESWITCH.bytecode()); + b.writeU1(0); //padding + b.writeU2(0); //padding + b.writeInt(0); //default + b.writeInt(Integer.MIN_VALUE); //low + b.writeInt(Integer.MAX_VALUE - 4); //high to jump back and cause infinite loop + b.writeU2(0);//exception handlers + b.writeU2(0);//attributes + }})))).methods().get(0).code().get().elementList()); } @Test