Added pass to verify structure of dex file.
When a dex file is first opened, this pass runs through to make sure
sizes and offsets of the various sections of the dex file match the
header and don't overlap.
Change-Id: I4900c9665d6572ccfca2fe5f79d5d48ce7252036
diff --git a/src/class_linker.cc b/src/class_linker.cc
index 02d9acb..5cd300e 100644
--- a/src/class_linker.cc
+++ b/src/class_linker.cc
@@ -581,6 +581,16 @@
// change process groups, so we don't get reaped by ProcessManager
setpgid(0, 0);
+ VLOG(class_linker) << dex2oat
+ << " --runtime-arg -Xms64m"
+ << " --runtime-arg -Xmx64m"
+ << " --runtime-arg -classpath"
+ << " --runtime-arg " << class_path
+ << " " << boot_image_option
+ << " " << dex_file_option
+ << " " << oat_fd_option
+ << " " << oat_name_option;
+
execl(dex2oat, dex2oat,
"--runtime-arg", "-Xms64m",
"--runtime-arg", "-Xmx64m",
diff --git a/src/dex2oat.cc b/src/dex2oat.cc
index 096c694..195c413 100644
--- a/src/dex2oat.cc
+++ b/src/dex2oat.cc
@@ -185,7 +185,7 @@
Compiler compiler(instruction_set_, image, image_classes);
compiler.CompileAll(class_loader->get(), dex_files);
- if (!OatWriter::Create(oat_file, class_loader->get(), compiler)) {
+ if (!OatWriter::Create(oat_file, class_loader->get(), dex_files, compiler)) {
LOG(ERROR) << "Failed to create oat file " << oat_file->name();
return false;
}
diff --git a/src/dex_file.cc b/src/dex_file.cc
index 5127a17..3f141b1 100644
--- a/src/dex_file.cc
+++ b/src/dex_file.cc
@@ -15,6 +15,7 @@
#include "UniquePtr.h"
#include "class_linker.h"
+#include "dex_file_verifier.h"
#include "globals.h"
#include "leb128.h"
#include "logging.h"
@@ -225,6 +226,9 @@
return false;
}
InitIndex();
+ if (!DexFileVerifier::Verify(this, base_, length_)) {
+ return false;
+ }
return true;
}
@@ -241,7 +245,7 @@
DCHECK_EQ(length_, header_->file_size_);
}
-bool DexFile::CheckMagicAndVersion() {
+bool DexFile::CheckMagicAndVersion() const {
CHECK(header_->magic_ != NULL) << GetLocation();
if (!IsMagicValid(header_->magic_)) {
LOG(ERROR) << "Unrecognized magic number in " << GetLocation() << ":"
diff --git a/src/dex_file.h b/src/dex_file.h
index a62c28f..2f2106b 100644
--- a/src/dex_file.h
+++ b/src/dex_file.h
@@ -26,6 +26,7 @@
static const byte kDexMagic[];
static const byte kDexMagicVersion[];
static const size_t kSha1DigestSize = 20;
+ static const uint32_t kDexEndianConstant = 0x12345678;
// name of the DexFile entry within a zip archive
static const char* kClassesDex;
@@ -65,6 +66,44 @@
DISALLOW_COPY_AND_ASSIGN(Header);
};
+ // Map item type codes.
+ enum {
+ kDexTypeHeaderItem = 0x0000,
+ kDexTypeStringIdItem = 0x0001,
+ kDexTypeTypeIdItem = 0x0002,
+ kDexTypeProtoIdItem = 0x0003,
+ kDexTypeFieldIdItem = 0x0004,
+ kDexTypeMethodIdItem = 0x0005,
+ kDexTypeClassDefItem = 0x0006,
+ kDexTypeMapList = 0x1000,
+ kDexTypeTypeList = 0x1001,
+ kDexTypeAnnotationSetRefList = 0x1002,
+ kDexTypeAnnotationSetItem = 0x1003,
+ kDexTypeClassDataItem = 0x2000,
+ kDexTypeCodeItem = 0x2001,
+ kDexTypeStringDataItem = 0x2002,
+ kDexTypeDebugInfoItem = 0x2003,
+ kDexTypeAnnotationItem = 0x2004,
+ kDexTypeEncodedArrayItem = 0x2005,
+ kDexTypeAnnotationsDirectoryItem = 0x2006,
+ };
+
+ struct MapItem {
+ uint16_t type_;
+ uint16_t unused_;
+ uint32_t size_;
+ uint32_t offset_;
+ private:
+ DISALLOW_COPY_AND_ASSIGN(MapItem);
+ };
+
+ struct MapList {
+ uint32_t size_;
+ MapItem list_[1];
+ private:
+ DISALLOW_COPY_AND_ASSIGN(MapList);
+ };
+
// Raw string_id_item.
struct StringId {
uint32_t string_data_off_; // offset in bytes from the base address
@@ -170,6 +209,90 @@
DISALLOW_COPY_AND_ASSIGN(TryItem);
};
+ // Annotation constants.
+ enum {
+ kDexVisibilityBuild = 0x00, /* annotation visibility */
+ kDexVisibilityRuntime = 0x01,
+ kDexVisibilitySystem = 0x02,
+
+ kDexAnnotationByte = 0x00,
+ kDexAnnotationShort = 0x02,
+ kDexAnnotationChar = 0x03,
+ kDexAnnotationInt = 0x04,
+ kDexAnnotationLong = 0x06,
+ kDexAnnotationFloat = 0x10,
+ kDexAnnotationDouble = 0x11,
+ kDexAnnotationString = 0x17,
+ kDexAnnotationType = 0x18,
+ kDexAnnotationField = 0x19,
+ kDexAnnotationMethod = 0x1a,
+ kDexAnnotationEnum = 0x1b,
+ kDexAnnotationArray = 0x1c,
+ kDexAnnotationAnnotation = 0x1d,
+ kDexAnnotationNull = 0x1e,
+ kDexAnnotationBoolean = 0x1f,
+
+ kDexAnnotationValueTypeMask = 0x1f, /* low 5 bits */
+ kDexAnnotationValueArgShift = 5,
+ };
+
+ struct AnnotationsDirectoryItem {
+ uint32_t class_annotations_off_;
+ uint32_t fields_size_;
+ uint32_t methods_size_;
+ uint32_t parameters_size_;
+ private:
+ DISALLOW_COPY_AND_ASSIGN(AnnotationsDirectoryItem);
+ };
+
+ struct FieldAnnotationsItem {
+ uint32_t field_idx_;
+ uint32_t annotations_off_;
+ private:
+ DISALLOW_COPY_AND_ASSIGN(FieldAnnotationsItem);
+ };
+
+ struct MethodAnnotationsItem {
+ uint32_t method_idx_;
+ uint32_t annotations_off_;
+ private:
+ DISALLOW_COPY_AND_ASSIGN(MethodAnnotationsItem);
+ };
+
+ struct ParameterAnnotationsItem {
+ uint32_t method_idx_;
+ uint32_t annotations_off_;
+ private:
+ DISALLOW_COPY_AND_ASSIGN(ParameterAnnotationsItem);
+ };
+
+ struct AnnotationSetRefItem {
+ uint32_t annotations_off_;
+ private:
+ DISALLOW_COPY_AND_ASSIGN(AnnotationSetRefItem);
+ };
+
+ struct AnnotationSetRefList {
+ uint32_t size_;
+ AnnotationSetRefItem list_[1];
+ private:
+ DISALLOW_COPY_AND_ASSIGN(AnnotationSetRefList);
+ };
+
+ struct AnnotationSetItem {
+ uint32_t size_;
+ uint32_t entries_[1];
+ private:
+ DISALLOW_COPY_AND_ASSIGN(AnnotationSetItem);
+ };
+
+ struct AnnotationItem {
+ uint8_t visibility_;
+ uint8_t annotation_[1];
+ private:
+ DISALLOW_COPY_AND_ASSIGN(AnnotationItem);
+ };
+
typedef std::pair<const DexFile*, const DexFile::ClassDef*> ClassPathEntry;
typedef std::vector<const DexFile*> ClassPath;
@@ -678,13 +801,12 @@
void InitIndex();
// Returns true if the header magic and version numbers are of the expected values.
- bool CheckMagicAndVersion();
+ bool CheckMagicAndVersion() const;
void DecodeDebugInfo0(const CodeItem* code_item, bool is_static, uint32_t method_idx,
DexDebugNewPositionCb posCb, DexDebugNewLocalCb local_cb,
void* cnxt, const byte* stream, LocalInfo* local_in_reg) const;
-
// The index of descriptors to class definition indexes (as opposed to type id indexes)
typedef std::map<const StringPiece, uint32_t> Index;
Index index_;
@@ -844,6 +966,10 @@
uint32_t GetMethodCodeItemOffset() const {
return method_.code_off_;
}
+ const byte* EndDataPointer() const {
+ CHECK(!HasNext());
+ return ptr_pos_;
+ }
private:
// A dex file's class_data_item is leb128 encoded, this structure holds a decoded form of the
// header for a class_data_item
diff --git a/src/dex_file_verifier.cc b/src/dex_file_verifier.cc
new file mode 100644
index 0000000..6a53ebe
--- /dev/null
+++ b/src/dex_file_verifier.cc
@@ -0,0 +1,1919 @@
+// Copyright 2011 Google Inc. All Rights Reserved.
+
+#include "dex_file_verifier.h"
+
+#include <map>
+
+#include "UniquePtr.h"
+#include "leb128.h"
+#include "object.h"
+#include "stringprintf.h"
+#include "zip_archive.h"
+
+namespace art {
+
+static uint32_t MapTypeToBitMask(uint32_t map_type) {
+ switch (map_type) {
+ case DexFile::kDexTypeHeaderItem: return 1 << 0;
+ case DexFile::kDexTypeStringIdItem: return 1 << 1;
+ case DexFile::kDexTypeTypeIdItem: return 1 << 2;
+ case DexFile::kDexTypeProtoIdItem: return 1 << 3;
+ case DexFile::kDexTypeFieldIdItem: return 1 << 4;
+ case DexFile::kDexTypeMethodIdItem: return 1 << 5;
+ case DexFile::kDexTypeClassDefItem: return 1 << 6;
+ case DexFile::kDexTypeMapList: return 1 << 7;
+ case DexFile::kDexTypeTypeList: return 1 << 8;
+ case DexFile::kDexTypeAnnotationSetRefList: return 1 << 9;
+ case DexFile::kDexTypeAnnotationSetItem: return 1 << 10;
+ case DexFile::kDexTypeClassDataItem: return 1 << 11;
+ case DexFile::kDexTypeCodeItem: return 1 << 12;
+ case DexFile::kDexTypeStringDataItem: return 1 << 13;
+ case DexFile::kDexTypeDebugInfoItem: return 1 << 14;
+ case DexFile::kDexTypeAnnotationItem: return 1 << 15;
+ case DexFile::kDexTypeEncodedArrayItem: return 1 << 16;
+ case DexFile::kDexTypeAnnotationsDirectoryItem: return 1 << 17;
+ }
+ return 0;
+}
+
+static bool IsDataSectionType(uint32_t map_type) {
+ switch (map_type) {
+ case DexFile::kDexTypeHeaderItem:
+ case DexFile::kDexTypeStringIdItem:
+ case DexFile::kDexTypeTypeIdItem:
+ case DexFile::kDexTypeProtoIdItem:
+ case DexFile::kDexTypeFieldIdItem:
+ case DexFile::kDexTypeMethodIdItem:
+ case DexFile::kDexTypeClassDefItem:
+ return false;
+ }
+ return true;
+}
+
+static bool CheckShortyDescriptorMatch(char shorty_char, const char* descriptor,
+ bool is_return_type) {
+ switch (shorty_char) {
+ case 'V':
+ if (!is_return_type) {
+ LOG(ERROR) << "Invalid use of void";
+ return false;
+ }
+ // Intentional fallthrough.
+ case 'B':
+ case 'C':
+ case 'D':
+ case 'F':
+ case 'I':
+ case 'J':
+ case 'S':
+ case 'Z':
+ if ((descriptor[0] != shorty_char) || (descriptor[1] != '\0')) {
+ LOG(ERROR) << StringPrintf("Shorty vs. primitive type mismatch: '%c', '%s'", shorty_char, descriptor);
+ return false;
+ }
+ break;
+ case 'L':
+ if ((descriptor[0] != 'L') && (descriptor[0] != '[')) {
+ LOG(ERROR) << StringPrintf("Shorty vs. type mismatch: '%c', '%s'", shorty_char, descriptor);
+ return false;
+ }
+ break;
+ default:
+ LOG(ERROR) << "Bad shorty character: '" << shorty_char << "'";
+ return false;
+ }
+ return true;
+}
+
+bool DexFileVerifier::Verify(DexFile* dex_file, const byte* base, size_t length) {
+ UniquePtr<DexFileVerifier> verifier(new DexFileVerifier(dex_file, base, length));
+ return verifier->Verify();
+}
+
+bool DexFileVerifier::CheckPointerRange(const void* start, const void* end, const char* label) const {
+ uint32_t range_start = reinterpret_cast<uint32_t>(start);
+ uint32_t range_end = reinterpret_cast<uint32_t>(end);
+ uint32_t file_start = reinterpret_cast<uint32_t>(base_);
+ uint32_t file_end = file_start + length_;
+ if ((range_start < file_start) || (range_start > file_end) ||
+ (range_end < file_start) || (range_end > file_end)) {
+ LOG(ERROR) << StringPrintf("Bad range for %s: %x to %x", label,
+ range_start - file_start, range_end - file_start);
+ return false;
+ }
+ return true;
+}
+
+bool DexFileVerifier::CheckListSize(const void* start, uint32_t count,
+ uint32_t element_size, const char* label) const {
+ const byte* list_start = reinterpret_cast<const byte*>(start);
+ return CheckPointerRange(list_start, list_start + (count * element_size), label);
+}
+
+bool DexFileVerifier::CheckIndex(uint32_t field, uint32_t limit, const char* label) const {
+ if (field >= limit) {
+ LOG(ERROR) << StringPrintf("Bad index for %s: %x >= %x", label, field, limit);
+ return false;
+ }
+ return true;
+}
+
+bool DexFileVerifier::CheckHeader() const {
+ // Check file length from the header.
+ uint32_t expected_length = header_->file_size_;
+ if (length_ != expected_length) {
+ LOG(ERROR) << "Bad file length (" << length_ << ", expected " << expected_length << ")";
+ return false;
+ }
+
+ // Compute and verify the checksum in the header.
+ uint32_t adler_checksum = adler32(0L, Z_NULL, 0);
+ const uint32_t non_sum = sizeof(header_->magic_) + sizeof(header_->checksum_);
+ const byte* non_sum_ptr = reinterpret_cast<const byte*>(header_) + non_sum;
+ adler_checksum = adler32(adler_checksum, non_sum_ptr, expected_length - non_sum);
+ if (adler_checksum != header_->checksum_) {
+ LOG(ERROR) << StringPrintf("Bad checksum (%08x, expected %08x)", adler_checksum, header_->checksum_);
+ return false;
+ }
+
+ // Check the contents of the header.
+ if (header_->endian_tag_ != DexFile::kDexEndianConstant) {
+ LOG(ERROR) << StringPrintf("Unexpected endian_tag: %x", header_->endian_tag_);
+ return false;
+ }
+
+ if (header_->header_size_ != sizeof(DexFile::Header)) {
+ LOG(ERROR) << "Bad header length: " << header_->header_size_;
+ return false;
+ }
+
+ return true;
+}
+
+bool DexFileVerifier::CheckMap() const {
+ const DexFile::MapList* map = reinterpret_cast<const DexFile::MapList*>(base_ + header_->map_off_);
+ const DexFile::MapItem* item = map->list_;
+
+ uint32_t count = map->size_;
+ uint32_t last_offset = 0;
+ uint32_t data_item_count = 0;
+ uint32_t data_items_left = header_->data_size_;
+ uint32_t used_bits = 0;
+
+ // Sanity check the size of the map list.
+ if (!CheckListSize(item, count, sizeof(DexFile::MapItem), "map size")) {
+ return false;
+ }
+
+ // Check the items listed in the map.
+ for (uint32_t i = 0; i < count; i++) {
+ if (last_offset >= item->offset_ && i != 0) {
+ LOG(ERROR) << StringPrintf("Out of order map item: %x then %x", last_offset, item->offset_);
+ return false;
+ }
+ if (item->offset_ >= header_->file_size_) {
+ LOG(ERROR) << StringPrintf("Map item after end of file: %x, size %x", item->offset_, header_->file_size_);
+ return false;
+ }
+
+ if (IsDataSectionType(item->type_)) {
+ uint32_t icount = item->size_;
+ if (icount > data_items_left) {
+ LOG(ERROR) << "Too many items in data section: " << data_item_count + icount;
+ return false;
+ }
+ data_items_left -= icount;
+ data_item_count += icount;
+ }
+
+ uint32_t bit = MapTypeToBitMask(item->type_);
+
+ if (bit == 0) {
+ LOG(ERROR) << StringPrintf("Unknown map section type %x", item->type_);
+ return false;
+ }
+
+ if ((used_bits & bit) != 0) {
+ LOG(ERROR) << StringPrintf("Duplicate map section of type %x", item->type_);
+ return false;
+ }
+
+ used_bits |= bit;
+ last_offset = item->offset_;
+ item++;
+ }
+
+ // Check for missing sections in the map.
+ if ((used_bits & MapTypeToBitMask(DexFile::kDexTypeHeaderItem)) == 0) {
+ LOG(ERROR) << "Map is missing header entry";
+ return false;
+ }
+ if ((used_bits & MapTypeToBitMask(DexFile::kDexTypeMapList)) == 0) {
+ LOG(ERROR) << "Map is missing map_list entry";
+ return false;
+ }
+ if ((used_bits & MapTypeToBitMask(DexFile::kDexTypeStringIdItem)) == 0 &&
+ ((header_->string_ids_off_ != 0) || (header_->string_ids_size_ != 0))) {
+ LOG(ERROR) << "Map is missing string_ids entry";
+ return false;
+ }
+ if ((used_bits & MapTypeToBitMask(DexFile::kDexTypeTypeIdItem)) == 0 &&
+ ((header_->type_ids_off_ != 0) || (header_->type_ids_size_ != 0))) {
+ LOG(ERROR) << "Map is missing type_ids entry";
+ return false;
+ }
+ if ((used_bits & MapTypeToBitMask(DexFile::kDexTypeProtoIdItem)) == 0 &&
+ ((header_->proto_ids_off_ != 0) || (header_->proto_ids_size_ != 0))) {
+ LOG(ERROR) << "Map is missing proto_ids entry";
+ return false;
+ }
+ if ((used_bits & MapTypeToBitMask(DexFile::kDexTypeFieldIdItem)) == 0 &&
+ ((header_->field_ids_off_ != 0) || (header_->field_ids_size_ != 0))) {
+ LOG(ERROR) << "Map is missing field_ids entry";
+ return false;
+ }
+ if ((used_bits & MapTypeToBitMask(DexFile::kDexTypeMethodIdItem)) == 0 &&
+ ((header_->method_ids_off_ != 0) || (header_->method_ids_size_ != 0))) {
+ LOG(ERROR) << "Map is missing method_ids entry";
+ return false;
+ }
+ if ((used_bits & MapTypeToBitMask(DexFile::kDexTypeClassDefItem)) == 0 &&
+ ((header_->class_defs_off_ != 0) || (header_->class_defs_size_ != 0))) {
+ LOG(ERROR) << "Map is missing class_defs entry";
+ return false;
+ }
+
+ return true;
+}
+
+uint32_t DexFileVerifier::ReadUnsignedLittleEndian(uint32_t size) {
+ uint32_t result = 0;
+ if (!CheckPointerRange(ptr_, ptr_ + size, "encoded_value")) {
+ return 0;
+ }
+
+ for (uint32_t i = 0; i < size; i++) {
+ result |= ((uint32_t) *(ptr_++)) << (i * 8);
+ }
+
+ return result;
+}
+
+bool DexFileVerifier::CheckAndGetHandlerOffsets(const DexFile::CodeItem* code_item,
+ uint32_t* handler_offsets, uint32_t handlers_size) {
+ const byte* handlers_base = DexFile::GetCatchHandlerData(*code_item, 0);
+
+ for (uint32_t i = 0; i < handlers_size; i++) {
+ bool catch_all;
+ uint32_t offset = reinterpret_cast<uint32_t>(ptr_) - reinterpret_cast<uint32_t>(handlers_base);
+ int32_t size = DecodeSignedLeb128(&ptr_);
+
+ if ((size < -65536) || (size > 65536)) {
+ LOG(ERROR) << "Invalid exception handler size: " << size;
+ return false;
+ }
+
+ if (size <= 0) {
+ catch_all = true;
+ size = -size;
+ } else {
+ catch_all = false;
+ }
+
+ handler_offsets[i] = offset;
+
+ while (size-- > 0) {
+ uint32_t type_idx = DecodeUnsignedLeb128(&ptr_);
+ if (!CheckIndex(type_idx, header_->type_ids_size_, "handler type_idx")) {
+ return false;
+ }
+
+ uint32_t addr = DecodeUnsignedLeb128(&ptr_);
+ if (addr >= code_item->insns_size_in_code_units_) {
+ LOG(ERROR) << StringPrintf("Invalid handler addr: %x", addr);
+ return false;
+ }
+ }
+
+ if (catch_all) {
+ uint32_t addr = DecodeUnsignedLeb128(&ptr_);
+ if (addr >= code_item->insns_size_in_code_units_) {
+ LOG(ERROR) << StringPrintf("Invalid handler catch_all_addr: %x", addr);
+ return false;
+ }
+ }
+ }
+
+ return true;
+}
+
+bool DexFileVerifier::CheckClassDataItemField(uint32_t idx, uint32_t access_flags,
+ bool expect_static) const {
+ if (!CheckIndex(idx, header_->field_ids_size_, "class_data_item field_idx")) {
+ return false;
+ }
+
+ bool is_static = (access_flags & kAccStatic) != 0;
+ if (is_static != expect_static) {
+ LOG(ERROR) << "Static/instance field not in expected list";
+ return false;
+ }
+
+ uint32_t access_field_mask = kAccPublic | kAccPrivate | kAccProtected | kAccStatic |
+ kAccFinal | kAccVolatile | kAccTransient | kAccSynthetic | kAccEnum;
+ if ((access_flags & ~access_field_mask) != 0) {
+ LOG(ERROR) << StringPrintf("Bad class_data_item field access_flags %x", access_flags);
+ return false;
+ }
+
+ return true;
+}
+
+bool DexFileVerifier::CheckClassDataItemMethod(uint32_t idx, uint32_t access_flags,
+ uint32_t code_offset, bool expect_direct) const {
+ if (!CheckIndex(idx, header_->method_ids_size_, "class_data_item method_idx")) {
+ return false;
+ }
+
+ bool is_direct = (access_flags & (kAccStatic | kAccPrivate | kAccConstructor)) != 0;
+ bool expect_code = (access_flags & (kAccNative | kAccAbstract)) == 0;
+ bool is_synchronized = (access_flags & kAccSynchronized) != 0;
+ bool allow_synchronized = (access_flags & kAccNative) != 0;
+
+ if (is_direct != expect_direct) {
+ LOG(ERROR) << "Direct/virtual method not in expected list";
+ return false;
+ }
+
+ uint32_t access_method_mask = kAccPublic | kAccPrivate | kAccProtected | kAccStatic |
+ kAccFinal | kAccSynchronized | kAccBridge | kAccVarargs | kAccNative | kAccAbstract |
+ kAccStrict | kAccSynthetic | kAccConstructor | kAccDeclaredSynchronized;
+ if (((access_flags & ~access_method_mask) != 0) || (is_synchronized && !allow_synchronized)) {
+ LOG(ERROR) << StringPrintf("Bad class_data_item method access_flags %x", access_flags);
+ return false;
+ }
+
+ if (expect_code && code_offset == 0) {
+ LOG(ERROR) << StringPrintf("Unexpected zero value for class_data_item method code_off with access flags %x", access_flags);
+ return false;
+ } else if (!expect_code && code_offset != 0) {
+ LOG(ERROR) << StringPrintf("Unexpected non-zero value %x for class_data_item method code_off with access flags %x", code_offset, access_flags);
+ return false;
+ }
+
+ return true;
+}
+
+bool DexFileVerifier::CheckPadding(uint32_t offset, uint32_t aligned_offset) {
+ if (offset < aligned_offset) {
+ if (!CheckPointerRange(base_ + offset, base_ + aligned_offset, "section")) {
+ return false;
+ }
+ while (offset < aligned_offset) {
+ if (*ptr_ != '\0') {
+ LOG(ERROR) << StringPrintf("Non-zero padding %x before section start at %x", *ptr_, offset);
+ return false;
+ }
+ ptr_++;
+ offset++;
+ }
+ }
+ return true;
+}
+
+bool DexFileVerifier::CheckEncodedValue() {
+ if (!CheckPointerRange(ptr_, ptr_ + 1, "encoded_value header")) {
+ return false;
+ }
+
+ uint8_t header_byte = *(ptr_++);
+ uint32_t value_type = header_byte & DexFile::kDexAnnotationValueTypeMask;
+ uint32_t value_arg = header_byte >> DexFile::kDexAnnotationValueArgShift;
+
+ switch (value_type) {
+ case DexFile::kDexAnnotationByte:
+ if (value_arg != 0) {
+ LOG(ERROR) << StringPrintf("Bad encoded_value byte size %x", value_arg);
+ return false;
+ }
+ ptr_++;
+ break;
+ case DexFile::kDexAnnotationShort:
+ case DexFile::kDexAnnotationChar:
+ if (value_arg > 1) {
+ LOG(ERROR) << StringPrintf("Bad encoded_value char/short size %x", value_arg);
+ return false;
+ }
+ ptr_ += value_arg + 1;
+ break;
+ case DexFile::kDexAnnotationInt:
+ case DexFile::kDexAnnotationFloat:
+ if (value_arg > 3) {
+ LOG(ERROR) << StringPrintf("Bad encoded_value int/float size %x", value_arg);
+ return false;
+ }
+ ptr_ += value_arg + 1;
+ break;
+ case DexFile::kDexAnnotationLong:
+ case DexFile::kDexAnnotationDouble:
+ ptr_ += value_arg + 1;
+ break;
+ case DexFile::kDexAnnotationString: {
+ if (value_arg > 3) {
+ LOG(ERROR) << StringPrintf("Bad encoded_value string size %x", value_arg);
+ return false;
+ }
+ uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1);
+ if (!CheckIndex(idx, header_->string_ids_size_, "encoded_value string")) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexAnnotationType: {
+ if (value_arg > 3) {
+ LOG(ERROR) << StringPrintf("Bad encoded_value type size %x", value_arg);
+ return false;
+ }
+ uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1);
+ if (!CheckIndex(idx, header_->type_ids_size_, "encoded_value type")) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexAnnotationField:
+ case DexFile::kDexAnnotationEnum: {
+ if (value_arg > 3) {
+ LOG(ERROR) << StringPrintf("Bad encoded_value field/enum size %x", value_arg);
+ return false;
+ }
+ uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1);
+ if (!CheckIndex(idx, header_->field_ids_size_, "encoded_value field")) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexAnnotationMethod: {
+ if (value_arg > 3) {
+ LOG(ERROR) << StringPrintf("Bad encoded_value method size %x", value_arg);
+ return false;
+ }
+ uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1);
+ if (!CheckIndex(idx, header_->method_ids_size_, "encoded_value method")) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexAnnotationArray:
+ if (value_arg != 0) {
+ LOG(ERROR) << StringPrintf("Bad encoded_value array value_arg %x", value_arg);
+ return false;
+ }
+ if (!CheckEncodedArray()) {
+ return false;
+ }
+ break;
+ case DexFile::kDexAnnotationAnnotation:
+ if (value_arg != 0) {
+ LOG(ERROR) << StringPrintf("Bad encoded_value annotation value_arg %x", value_arg);
+ return false;
+ }
+ if (!CheckEncodedAnnotation()) {
+ return false;
+ }
+ break;
+ case DexFile::kDexAnnotationNull:
+ if (value_arg != 0) {
+ LOG(ERROR) << StringPrintf("Bad encoded_value null value_arg %x", value_arg);
+ return false;
+ }
+ break;
+ case DexFile::kDexAnnotationBoolean:
+ if (value_arg > 1) {
+ LOG(ERROR) << StringPrintf("Bad encoded_value boolean size %x", value_arg);
+ return false;
+ }
+ break;
+ default:
+ LOG(ERROR) << StringPrintf("Bogus encoded_value value_type %x", value_type);
+ return false;
+ }
+
+ return true;
+}
+
+bool DexFileVerifier::CheckEncodedArray() {
+ uint32_t size = DecodeUnsignedLeb128(&ptr_);
+
+ while (size--) {
+ if (!CheckEncodedValue()) {
+ LOG(ERROR) << "Bad encoded_array value";
+ return false;
+ }
+ }
+ return true;
+}
+
+bool DexFileVerifier::CheckEncodedAnnotation() {
+ uint32_t idx = DecodeUnsignedLeb128(&ptr_);
+ if (!CheckIndex(idx, header_->type_ids_size_, "encoded_annotation type_idx")) {
+ return false;
+ }
+
+ uint32_t size = DecodeUnsignedLeb128(&ptr_);
+ uint32_t last_idx = 0;
+
+ for (uint32_t i = 0; i < size; i++) {
+ idx = DecodeUnsignedLeb128(&ptr_);
+ if (!CheckIndex(idx, header_->string_ids_size_, "annotation_element name_idx")) {
+ return false;
+ }
+
+ if (last_idx >= idx && i != 0) {
+ LOG(ERROR) << StringPrintf("Out-of-order annotation_element name_idx: %x then %x", last_idx, idx);
+ return false;
+ }
+
+ if (!CheckEncodedValue()) {
+ return false;
+ }
+
+ last_idx = idx;
+ }
+ return true;
+}
+
+bool DexFileVerifier::CheckIntraClassDataItem() {
+ ClassDataItemIterator it(*dex_file_, ptr_);
+
+ for (; it.HasNextStaticField(); it.Next()) {
+ if (!CheckClassDataItemField(it.GetMemberIndex(), it.GetMemberAccessFlags(), true)) {
+ return false;
+ }
+ }
+ for (; it.HasNextInstanceField(); it.Next()) {
+ if (!CheckClassDataItemField(it.GetMemberIndex(), it.GetMemberAccessFlags(), false)) {
+ return false;
+ }
+ }
+ for (; it.HasNextDirectMethod(); it.Next()) {
+ if (!CheckClassDataItemMethod(it.GetMemberIndex(), it.GetMemberAccessFlags(),
+ it.GetMethodCodeItemOffset(), true)) {
+ return false;
+ }
+ }
+ for (; it.HasNextVirtualMethod(); it.Next()) {
+ if (!CheckClassDataItemMethod(it.GetMemberIndex(), it.GetMemberAccessFlags(),
+ it.GetMethodCodeItemOffset(), false)) {
+ return false;
+ }
+ }
+
+ ptr_ = it.EndDataPointer();
+ return true;
+}
+
+bool DexFileVerifier::CheckIntraCodeItem() {
+ const DexFile::CodeItem* code_item = reinterpret_cast<const DexFile::CodeItem*>(ptr_);
+ if (!CheckPointerRange(code_item, code_item + 1, "code")) {
+ return false;
+ }
+
+ if (code_item->ins_size_ > code_item->registers_size_) {
+ LOG(ERROR) << "ins_size (" << code_item->ins_size_ << ") > registers_size ("
+ << code_item->registers_size_ << ")";
+ return false;
+ }
+
+ if ((code_item->outs_size_ > 5) && (code_item->outs_size_ > code_item->registers_size_)) {
+ /*
+ * outs_size can be up to 5, even if registers_size is smaller, since the
+ * short forms of method invocation allow repetitions of a register multiple
+ * times within a single parameter list. However, longer parameter lists
+ * need to be represented in-order in the register file.
+ */
+ LOG(ERROR) << "outs_size (" << code_item->outs_size_ << ") > registers_size ("
+ << code_item->registers_size_ << ")";
+ return false;
+ }
+
+ const uint16_t* insns = code_item->insns_;
+ uint32_t insns_size = code_item->insns_size_in_code_units_;
+ if (!CheckListSize(insns, insns_size, sizeof(uint16_t), "insns size")) {
+ return false;
+ }
+
+ // Grab the end of the insns if there are no try_items.
+ uint32_t try_items_size = code_item->tries_size_;
+ if (try_items_size == 0) {
+ ptr_ = reinterpret_cast<const byte*>(&insns[insns_size]);
+ return true;
+ }
+
+ // try_items are 4-byte aligned. Verify the spacer is 0.
+ if ((((uint32_t) &insns[insns_size] & 3) != 0) && (insns[insns_size] != 0)) {
+ LOG(ERROR) << StringPrintf("Non-zero padding: %x", insns[insns_size]);
+ return false;
+ }
+
+ const DexFile::TryItem* try_items = DexFile::GetTryItems(*code_item, 0);
+ ptr_ = DexFile::GetCatchHandlerData(*code_item, 0);
+ uint32_t handlers_size = DecodeUnsignedLeb128(&ptr_);
+
+ if (!CheckListSize(try_items, try_items_size, sizeof(DexFile::TryItem), "try_items size")) {
+ return false;
+ }
+
+ if ((handlers_size == 0) || (handlers_size >= 65536)) {
+ LOG(ERROR) << "Invalid handlers_size: " << handlers_size;
+ return false;
+ }
+
+ uint32_t handler_offsets[handlers_size];
+ if (!CheckAndGetHandlerOffsets(code_item, handler_offsets, handlers_size)) {
+ return false;
+ }
+
+ uint32_t last_addr = 0;
+ while (try_items_size--) {
+ if (try_items->start_addr_ < last_addr) {
+ LOG(ERROR) << StringPrintf("Out-of_order try_item with start_addr: %x", try_items->start_addr_);
+ return false;
+ }
+
+ if (try_items->start_addr_ >= insns_size) {
+ LOG(ERROR) << StringPrintf("Invalid try_item start_addr: %x", try_items->start_addr_);
+ return false;
+ }
+
+ uint32_t i;
+ for (i = 0; i < handlers_size; i++) {
+ if (try_items->handler_off_ == handler_offsets[i]) {
+ break;
+ }
+ }
+
+ if (i == handlers_size) {
+ LOG(ERROR) << StringPrintf("Bogus handler offset: %x", try_items->handler_off_);
+ return false;
+ }
+
+ last_addr = try_items->start_addr_ + try_items->insn_count_;
+ if (last_addr > insns_size) {
+ LOG(ERROR) << StringPrintf("Invalid try_item insn_count: %x", try_items->insn_count_);
+ return false;
+ }
+
+ try_items++;
+ }
+
+ return true;
+}
+
+bool DexFileVerifier::CheckIntraStringDataItem() {
+ uint32_t size = DecodeUnsignedLeb128(&ptr_);
+ const byte* file_end = base_ + length_;
+
+ for (uint32_t i = 0; i < size; i++) {
+ if (ptr_ >= file_end) {
+ LOG(ERROR) << "String data would go beyond end-of-file";
+ return false;
+ }
+
+ uint8_t byte = *(ptr_++);
+
+ // Switch on the high 4 bits.
+ switch (byte >> 4) {
+ case 0x00:
+ // Special case of bit pattern 0xxx.
+ if (byte == 0) {
+ LOG(ERROR) << StringPrintf("String data shorter than indicated utf16_size %x", size);
+ return false;
+ }
+ break;
+ case 0x01:
+ case 0x02:
+ case 0x03:
+ case 0x04:
+ case 0x05:
+ case 0x06:
+ case 0x07:
+ // No extra checks necessary for bit pattern 0xxx.
+ break;
+ case 0x08:
+ case 0x09:
+ case 0x0a:
+ case 0x0b:
+ case 0x0f:
+ // Illegal bit patterns 10xx or 1111.
+ // Note: 1111 is valid for normal UTF-8, but not here.
+ LOG(ERROR) << StringPrintf("Illegal start byte %x in string data", byte);
+ return false;
+ case 0x0c:
+ case 0x0d: {
+ // Bit pattern 110x has an additional byte.
+ uint8_t byte2 = *(ptr_++);
+ if ((byte2 & 0xc0) != 0x80) {
+ LOG(ERROR) << StringPrintf("Illegal continuation byte %x in string data", byte2);
+ return false;
+ }
+ uint16_t value = ((byte & 0x1f) << 6) | (byte2 & 0x3f);
+ if ((value != 0) && (value < 0x80)) {
+ LOG(ERROR) << StringPrintf("Illegal representation for value %x in string data", value);
+ return false;
+ }
+ break;
+ }
+ case 0x0e: {
+ // Bit pattern 1110 has 2 additional bytes.
+ uint8_t byte2 = *(ptr_++);
+ if ((byte2 & 0xc0) != 0x80) {
+ LOG(ERROR) << StringPrintf("Illegal continuation byte %x in string data", byte2);
+ return false;
+ }
+ uint8_t byte3 = *(ptr_++);
+ if ((byte3 & 0xc0) != 0x80) {
+ LOG(ERROR) << StringPrintf("Illegal continuation byte %x in string data", byte3);
+ return false;
+ }
+ uint16_t value = ((byte & 0x0f) << 12) | ((byte2 & 0x3f) << 6) | (byte3 & 0x3f);
+ if (value < 0x800) {
+ LOG(ERROR) << StringPrintf("Illegal representation for value %x in string data", value);
+ return false;
+ }
+ break;
+ }
+ }
+ }
+
+ if (*(ptr_++) != '\0') {
+ LOG(ERROR) << StringPrintf("String longer than indicated size %x", size);
+ return false;
+ }
+
+ return true;
+}
+
+bool DexFileVerifier::CheckIntraDebugInfoItem() {
+ DecodeUnsignedLeb128(&ptr_);
+ uint32_t parameters_size = DecodeUnsignedLeb128(&ptr_);
+ if (parameters_size > 65536) {
+ LOG(ERROR) << StringPrintf("Invalid parameters_size: %x", parameters_size);
+ return false;
+ }
+
+ for (uint32_t j = 0; j < parameters_size; j++) {
+ uint32_t parameter_name = DecodeUnsignedLeb128(&ptr_);
+ if (parameter_name != 0) {
+ parameter_name--;
+ if (!CheckIndex(parameter_name, header_->string_ids_size_, "debug_info_item parameter_name")) {
+ return false;
+ }
+ }
+ }
+
+ while (true) {
+ uint8_t opcode = *(ptr_++);
+ switch (opcode) {
+ case DexFile::DBG_END_SEQUENCE: {
+ return true;
+ }
+ case DexFile::DBG_ADVANCE_PC: {
+ DecodeUnsignedLeb128(&ptr_);
+ break;
+ }
+ case DexFile::DBG_ADVANCE_LINE: {
+ DecodeSignedLeb128(&ptr_);
+ break;
+ }
+ case DexFile::DBG_START_LOCAL: {
+ uint32_t reg_num = DecodeUnsignedLeb128(&ptr_);
+ if (reg_num >= 65536) {
+ LOG(ERROR) << StringPrintf("Bad reg_num for opcode %x", opcode);
+ return false;
+ }
+ uint32_t name_idx = DecodeUnsignedLeb128(&ptr_);
+ if (name_idx != 0) {
+ name_idx--;
+ if (!CheckIndex(name_idx, header_->string_ids_size_, "DBG_START_LOCAL name_idx")) {
+ return false;
+ }
+ }
+ uint32_t type_idx = DecodeUnsignedLeb128(&ptr_);
+ if (type_idx != 0) {
+ type_idx--;
+ if (!CheckIndex(type_idx, header_->string_ids_size_, "DBG_START_LOCAL type_idx")) {
+ return false;
+ }
+ }
+ break;
+ }
+ case DexFile::DBG_END_LOCAL:
+ case DexFile::DBG_RESTART_LOCAL: {
+ uint32_t reg_num = DecodeUnsignedLeb128(&ptr_);
+ if (reg_num >= 65536) {
+ LOG(ERROR) << StringPrintf("Bad reg_num for opcode %x", opcode);
+ return false;
+ }
+ break;
+ }
+ case DexFile::DBG_START_LOCAL_EXTENDED: {
+ uint32_t reg_num = DecodeUnsignedLeb128(&ptr_);
+ if (reg_num >= 65536) {
+ LOG(ERROR) << StringPrintf("Bad reg_num for opcode %x", opcode);
+ return false;
+ }
+ uint32_t name_idx = DecodeUnsignedLeb128(&ptr_);
+ if (name_idx != 0) {
+ name_idx--;
+ if (!CheckIndex(name_idx, header_->string_ids_size_, "DBG_START_LOCAL_EXTENDED name_idx")) {
+ return false;
+ }
+ }
+ uint32_t type_idx = DecodeUnsignedLeb128(&ptr_);
+ if (type_idx != 0) {
+ type_idx--;
+ if (!CheckIndex(type_idx, header_->string_ids_size_, "DBG_START_LOCAL_EXTENDED type_idx")) {
+ return false;
+ }
+ }
+ uint32_t sig_idx = DecodeUnsignedLeb128(&ptr_);
+ if (sig_idx != 0) {
+ sig_idx--;
+ if (!CheckIndex(sig_idx, header_->string_ids_size_, "DBG_START_LOCAL_EXTENDED sig_idx")) {
+ return false;
+ }
+ }
+ break;
+ }
+ case DexFile::DBG_SET_FILE: {
+ uint32_t name_idx = DecodeUnsignedLeb128(&ptr_);
+ if (name_idx != 0) {
+ name_idx--;
+ if (!CheckIndex(name_idx, header_->string_ids_size_, "DBG_SET_FILE name_idx")) {
+ return false;
+ }
+ }
+ break;
+ }
+ }
+ }
+}
+
+bool DexFileVerifier::CheckIntraAnnotationItem() {
+ if (!CheckPointerRange(ptr_, ptr_ + 1, "annotation visibility")) {
+ return false;
+ }
+
+ // Check visibility
+ switch (*(ptr_++)) {
+ case DexFile::kDexVisibilityBuild:
+ case DexFile::kDexVisibilityRuntime:
+ case DexFile::kDexVisibilitySystem:
+ break;
+ default:
+ LOG(ERROR) << StringPrintf("Bad annotation visibility: %x", *ptr_);
+ return false;
+ }
+
+ if (!CheckEncodedAnnotation()) {
+ return false;
+ }
+
+ return true;
+}
+
+bool DexFileVerifier::CheckIntraAnnotationsDirectoryItem() {
+ const DexFile::AnnotationsDirectoryItem* item =
+ reinterpret_cast<const DexFile::AnnotationsDirectoryItem*>(ptr_);
+ if (!CheckPointerRange(item, item + 1, "annotations_directory")) {
+ return false;
+ }
+
+ // Field annotations follow immediately after the annotations directory.
+ const DexFile::FieldAnnotationsItem* field_item =
+ reinterpret_cast<const DexFile::FieldAnnotationsItem*>(item + 1);
+ uint32_t field_count = item->fields_size_;
+ if (!CheckListSize(field_item, field_count, sizeof(DexFile::FieldAnnotationsItem), "field_annotations list")) {
+ return false;
+ }
+
+ uint32_t last_idx = 0;
+ for (uint32_t i = 0; i < field_count; i++) {
+ if (last_idx >= field_item->field_idx_ && i != 0) {
+ LOG(ERROR) << StringPrintf("Out-of-order field_idx for annotation: %x then %x", last_idx, field_item->field_idx_);
+ return false;
+ }
+ last_idx = field_item->field_idx_;
+ field_item++;
+ }
+
+ // Method annotations follow immediately after field annotations.
+ const DexFile::MethodAnnotationsItem* method_item =
+ reinterpret_cast<const DexFile::MethodAnnotationsItem*>(field_item);
+ uint32_t method_count = item->methods_size_;
+ if (!CheckListSize(method_item, method_count, sizeof(DexFile::MethodAnnotationsItem), "method_annotations list")) {
+ return false;
+ }
+
+ last_idx = 0;
+ for (uint32_t i = 0; i < method_count; i++) {
+ if (last_idx >= method_item->method_idx_ && i != 0) {
+ LOG(ERROR) << StringPrintf("Out-of-order method_idx for annotation: %x then %x", last_idx, method_item->method_idx_);
+ return false;
+ }
+ last_idx = method_item->method_idx_;
+ method_item++;
+ }
+
+ // Parameter annotations follow immediately after method annotations.
+ const DexFile::ParameterAnnotationsItem* parameter_item =
+ reinterpret_cast<const DexFile::ParameterAnnotationsItem*>(method_item);
+ uint32_t parameter_count = item->parameters_size_;
+ if (!CheckListSize(parameter_item, parameter_count, sizeof(DexFile::ParameterAnnotationsItem), "parameter_annotations list")) {
+ return false;
+ }
+
+ last_idx = 0;
+ for (uint32_t i = 0; i < parameter_count; i++) {
+ if (last_idx >= parameter_item->method_idx_ && i != 0) {
+ LOG(ERROR) << StringPrintf("Out-of-order method_idx for annotation: %x then %x", last_idx, parameter_item->method_idx_);
+ return false;
+ }
+ last_idx = parameter_item->method_idx_;
+ parameter_item++;
+ }
+
+ // Return a pointer to the end of the annotations.
+ ptr_ = reinterpret_cast<const byte*>(parameter_item);
+ return true;
+}
+
+bool DexFileVerifier::CheckIntraSectionIterate(uint32_t offset, uint32_t count, uint16_t type) {
+ // Get the right alignment mask for the type of section.
+ uint32_t alignment_mask;
+ switch (type) {
+ case DexFile::kDexTypeClassDataItem:
+ case DexFile::kDexTypeStringDataItem:
+ case DexFile::kDexTypeDebugInfoItem:
+ case DexFile::kDexTypeAnnotationItem:
+ case DexFile::kDexTypeEncodedArrayItem:
+ alignment_mask = sizeof(uint8_t) - 1;
+ break;
+ default:
+ alignment_mask = sizeof(uint32_t) - 1;
+ break;
+ }
+
+ // Iterate through the items in the section.
+ for (uint32_t i = 0; i < count; i++) {
+ uint32_t aligned_offset = (offset + alignment_mask) & ~alignment_mask;
+
+ // Check the padding between items.
+ if (!CheckPadding(offset, aligned_offset)) {
+ return false;
+ }
+
+ // Check depending on the section type.
+ switch (type) {
+ case DexFile::kDexTypeStringIdItem: {
+ if (!CheckPointerRange(ptr_, ptr_ + sizeof(DexFile::StringId), "string_ids")) {
+ return false;
+ }
+ ptr_ += sizeof(DexFile::StringId);
+ break;
+ }
+ case DexFile::kDexTypeTypeIdItem: {
+ if (!CheckPointerRange(ptr_, ptr_ + sizeof(DexFile::TypeId), "type_ids")) {
+ return false;
+ }
+ ptr_ += sizeof(DexFile::TypeId);
+ break;
+ }
+ case DexFile::kDexTypeProtoIdItem: {
+ if (!CheckPointerRange(ptr_, ptr_ + sizeof(DexFile::ProtoId), "proto_ids")) {
+ return false;
+ }
+ ptr_ += sizeof(DexFile::ProtoId);
+ break;
+ }
+ case DexFile::kDexTypeFieldIdItem: {
+ if (!CheckPointerRange(ptr_, ptr_ + sizeof(DexFile::FieldId), "field_ids")) {
+ return false;
+ }
+ ptr_ += sizeof(DexFile::FieldId);
+ break;
+ }
+ case DexFile::kDexTypeMethodIdItem: {
+ if (!CheckPointerRange(ptr_, ptr_ + sizeof(DexFile::MethodId), "method_ids")) {
+ return false;
+ }
+ ptr_ += sizeof(DexFile::MethodId);
+ break;
+ }
+ case DexFile::kDexTypeClassDefItem: {
+ if (!CheckPointerRange(ptr_, ptr_ + sizeof(DexFile::ClassDef), "class_defs")) {
+ return false;
+ }
+ ptr_ += sizeof(DexFile::ClassDef);
+ break;
+ }
+ case DexFile::kDexTypeTypeList: {
+ const DexFile::TypeList* list = reinterpret_cast<const DexFile::TypeList*>(ptr_);
+ const DexFile::TypeItem* item = &list->GetTypeItem(0);
+ uint32_t count = list->Size();
+
+ if (!CheckPointerRange(list, list + 1, "type_list") ||
+ !CheckListSize(item, count, sizeof(DexFile::TypeItem), "type_list size")) {
+ return false;
+ }
+ ptr_ = reinterpret_cast<const byte*>(item + count);
+ break;
+ }
+ case DexFile::kDexTypeAnnotationSetRefList: {
+ const DexFile::AnnotationSetRefList* list =
+ reinterpret_cast<const DexFile::AnnotationSetRefList*>(ptr_);
+ const DexFile::AnnotationSetRefItem* item = list->list_;
+ uint32_t count = list->size_;
+
+ if (!CheckPointerRange(list, list + 1, "annotation_set_ref_list") ||
+ !CheckListSize(item, count, sizeof(DexFile::AnnotationSetRefItem), "annotation_set_ref_list size")) {
+ return false;
+ }
+ ptr_ = reinterpret_cast<const byte*>(item + count);
+ break;
+ }
+ case DexFile::kDexTypeAnnotationSetItem: {
+ const DexFile::AnnotationSetItem* set =
+ reinterpret_cast<const DexFile::AnnotationSetItem*>(ptr_);
+ const uint32_t* item = set->entries_;
+ uint32_t count = set->size_;
+
+ if (!CheckPointerRange(set, set + 1, "annotation_set_item") ||
+ !CheckListSize(item, count, sizeof(uint32_t), "annotation_set_item size")) {
+ return false;
+ }
+ ptr_ = reinterpret_cast<const byte*>(item + count);
+ break;
+ }
+ case DexFile::kDexTypeClassDataItem: {
+ if (!CheckIntraClassDataItem()) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexTypeCodeItem: {
+ if (!CheckIntraCodeItem()) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexTypeStringDataItem: {
+ if (!CheckIntraStringDataItem()) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexTypeDebugInfoItem: {
+ if (!CheckIntraDebugInfoItem()) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexTypeAnnotationItem: {
+ if (!CheckIntraAnnotationItem()) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexTypeEncodedArrayItem: {
+ if (!CheckEncodedArray()) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexTypeAnnotationsDirectoryItem: {
+ if (!CheckIntraAnnotationsDirectoryItem()) {
+ return false;
+ }
+ break;
+ }
+ default:
+ LOG(ERROR) << StringPrintf("Unknown map item type %x", type);
+ return false;
+ }
+
+ if (IsDataSectionType(type)) {
+ offset_to_type_map_.insert(std::make_pair(aligned_offset, type));
+ }
+
+ aligned_offset = reinterpret_cast<uint32_t>(ptr_) - reinterpret_cast<uint32_t>(base_);
+ if (aligned_offset > length_) {
+ LOG(ERROR) << StringPrintf("Item %d at ends out of bounds", i);
+ return false;
+ }
+
+ offset = aligned_offset;
+ }
+
+ return true;
+}
+
+bool DexFileVerifier::CheckIntraIdSection(uint32_t offset, uint32_t count, uint16_t type) {
+ uint32_t expected_offset;
+ uint32_t expected_size;
+
+ // Get the expected offset and size from the header.
+ switch (type) {
+ case DexFile::kDexTypeStringIdItem:
+ expected_offset = header_->string_ids_off_;
+ expected_size = header_->string_ids_size_;
+ break;
+ case DexFile::kDexTypeTypeIdItem:
+ expected_offset = header_->type_ids_off_;
+ expected_size = header_->type_ids_size_;
+ break;
+ case DexFile::kDexTypeProtoIdItem:
+ expected_offset = header_->proto_ids_off_;
+ expected_size = header_->proto_ids_size_;
+ break;
+ case DexFile::kDexTypeFieldIdItem:
+ expected_offset = header_->field_ids_off_;
+ expected_size = header_->field_ids_size_;
+ break;
+ case DexFile::kDexTypeMethodIdItem:
+ expected_offset = header_->method_ids_off_;
+ expected_size = header_->method_ids_size_;
+ break;
+ case DexFile::kDexTypeClassDefItem:
+ expected_offset = header_->class_defs_off_;
+ expected_size = header_->class_defs_size_;
+ break;
+ default:
+ LOG(ERROR) << StringPrintf("Bad type for id section: %x", type);
+ return false;
+ }
+
+ // Check that the offset and size are what were expected from the header.
+ if (offset != expected_offset) {
+ LOG(ERROR) << StringPrintf("Bad offset for section: got %x, expected %x", offset, expected_offset);
+ return false;
+ }
+ if (count != expected_size) {
+ LOG(ERROR) << StringPrintf("Bad size for section: got %x, expected %x", count, expected_size);
+ return false;
+ }
+
+ return CheckIntraSectionIterate(offset, count, type);
+}
+
+bool DexFileVerifier::CheckIntraDataSection(uint32_t offset, uint32_t count, uint16_t type) {
+ uint32_t data_start = header_->data_off_;
+ uint32_t data_end = data_start + header_->data_size_;
+
+ // Sanity check the offset of the section.
+ if ((offset < data_start) || (offset > data_end)) {
+ LOG(ERROR) << StringPrintf("Bad offset for data subsection: %x", offset);
+ return false;
+ }
+
+ if (!CheckIntraSectionIterate(offset, count, type)) {
+ return false;
+ }
+
+ uint32_t next_offset = reinterpret_cast<uint32_t>(ptr_) - reinterpret_cast<uint32_t>(base_);
+ if (next_offset > data_end) {
+ LOG(ERROR) << StringPrintf("Out-of-bounds end of data subsection: %x", next_offset);
+ return false;
+ }
+
+ return true;
+}
+
+bool DexFileVerifier::CheckIntraSection() {
+ const DexFile::MapList* map = reinterpret_cast<const DexFile::MapList*>(base_ + header_->map_off_);
+ const DexFile::MapItem* item = map->list_;
+
+ uint32_t count = map->size_;
+ uint32_t offset = 0;
+ ptr_ = base_;
+
+ // Check the items listed in the map.
+ while (count--) {
+ uint32_t section_offset = item->offset_;
+ uint32_t section_count = item->size_;
+ uint16_t type = item->type_;
+
+ // Check for padding and overlap between items.
+ if (!CheckPadding(offset, section_offset)) {
+ return false;
+ } else if (offset > section_offset) {
+ LOG(ERROR) << StringPrintf("Section overlap or out-of-order map: %x, %x", offset, section_offset);
+ return false;
+ }
+
+ // Check each item based on its type.
+ switch (type) {
+ case DexFile::kDexTypeHeaderItem:
+ if (section_count != 1) {
+ LOG(ERROR) << "Multiple header items";
+ return false;
+ }
+ if (section_offset != 0) {
+ LOG(ERROR) << StringPrintf("Header at %x, not at start of file", section_offset);
+ return false;
+ }
+ ptr_ = base_ + header_->header_size_;
+ offset = header_->header_size_;
+ break;
+ case DexFile::kDexTypeStringIdItem:
+ case DexFile::kDexTypeTypeIdItem:
+ case DexFile::kDexTypeProtoIdItem:
+ case DexFile::kDexTypeFieldIdItem:
+ case DexFile::kDexTypeMethodIdItem:
+ case DexFile::kDexTypeClassDefItem:
+ if (!CheckIntraIdSection(section_offset, section_count, type)) {
+ return false;
+ }
+ offset = reinterpret_cast<uint32_t>(ptr_) - reinterpret_cast<uint32_t>(base_);
+ break;
+ case DexFile::kDexTypeMapList:
+ if (section_count != 1) {
+ LOG(ERROR) << "Multiple map list items";
+ return false;
+ }
+ if (section_offset != header_->map_off_) {
+ LOG(ERROR) << StringPrintf("Map not at header-defined offset: %x, expected %x", section_offset, header_->map_off_);
+ return false;
+ }
+ ptr_ += sizeof(uint32_t) + (map->size_ * sizeof(DexFile::MapItem));
+ offset = section_offset + sizeof(uint32_t) + (map->size_ * sizeof(DexFile::MapItem));
+ break;
+ case DexFile::kDexTypeTypeList:
+ case DexFile::kDexTypeAnnotationSetRefList:
+ case DexFile::kDexTypeAnnotationSetItem:
+ case DexFile::kDexTypeClassDataItem:
+ case DexFile::kDexTypeCodeItem:
+ case DexFile::kDexTypeStringDataItem:
+ case DexFile::kDexTypeDebugInfoItem:
+ case DexFile::kDexTypeAnnotationItem:
+ case DexFile::kDexTypeEncodedArrayItem:
+ case DexFile::kDexTypeAnnotationsDirectoryItem:
+ if (!CheckIntraDataSection(section_offset, section_count, type)) {
+ return false;
+ }
+ offset = reinterpret_cast<uint32_t>(ptr_) - reinterpret_cast<uint32_t>(base_);
+ break;
+ default:
+ LOG(ERROR) << StringPrintf("Unknown map item type %x", type);
+ return false;
+ }
+
+ item++;
+ }
+
+ return true;
+}
+
+bool DexFileVerifier::CheckOffsetToTypeMap(uint32_t offset, uint16_t type) {
+ typedef std::map<uint32_t, uint16_t>::iterator It; // TODO: C++0x auto
+ It it = offset_to_type_map_.find(offset);
+ if (it == offset_to_type_map_.end()) {
+ LOG(ERROR) << StringPrintf("No data map entry found @ %x; expected %x", offset, type);
+ return false;
+ }
+ if (it->second != type) {
+ LOG(ERROR) << StringPrintf("Unexpected data map entry @ %x; expected %x, found %x", offset, type, it->second);
+ return false;
+ }
+ return true;
+}
+
+uint16_t DexFileVerifier::FindFirstClassDataDefiner(const byte* ptr) const {
+ ClassDataItemIterator it(*dex_file_, ptr);
+
+ if (it.HasNextStaticField() || it.HasNextInstanceField()) {
+ const DexFile::FieldId& field = dex_file_->GetFieldId(it.GetMemberIndex());
+ return field.class_idx_;
+ }
+
+ if (it.HasNextDirectMethod() || it.HasNextVirtualMethod()) {
+ const DexFile::MethodId& method = dex_file_->GetMethodId(it.GetMemberIndex());
+ return method.class_idx_;
+ }
+
+ return DexFile::kDexNoIndex16;
+}
+
+uint16_t DexFileVerifier::FindFirstAnnotationsDirectoryDefiner(const byte* ptr) const {
+ const DexFile::AnnotationsDirectoryItem* item =
+ reinterpret_cast<const DexFile::AnnotationsDirectoryItem*>(ptr);
+ if (item->fields_size_ != 0) {
+ DexFile::FieldAnnotationsItem* field_items = (DexFile::FieldAnnotationsItem*) (item + 1);
+ const DexFile::FieldId& field = dex_file_->GetFieldId(field_items[0].field_idx_);
+ return field.class_idx_;
+ }
+
+ if (item->methods_size_ != 0) {
+ DexFile::MethodAnnotationsItem* method_items = (DexFile::MethodAnnotationsItem*) (item + 1);
+ const DexFile::MethodId& method = dex_file_->GetMethodId(method_items[0].method_idx_);
+ return method.class_idx_;
+ }
+
+ if (item->parameters_size_ != 0) {
+ DexFile::ParameterAnnotationsItem* parameter_items = (DexFile::ParameterAnnotationsItem*) (item + 1);
+ const DexFile::MethodId& method = dex_file_->GetMethodId(parameter_items[0].method_idx_);
+ return method.class_idx_;
+ }
+
+ return DexFile::kDexNoIndex16;
+}
+
+bool DexFileVerifier::CheckInterStringIdItem() {
+ const DexFile::StringId* item = reinterpret_cast<const DexFile::StringId*>(ptr_);
+
+ // Check the map to make sure it has the right offset->type.
+ if (!CheckOffsetToTypeMap(item->string_data_off_, DexFile::kDexTypeStringDataItem)) {
+ return false;
+ }
+
+ // Check ordering between items.
+ if (previous_item_ != NULL) {
+ const DexFile::StringId* prev_item = reinterpret_cast<const DexFile::StringId*>(previous_item_);
+ const char* prev_str = dex_file_->GetStringData(*prev_item);
+ const char* str = dex_file_->GetStringData(*item);
+ if (CompareModifiedUtf8ToModifiedUtf8AsUtf16CodePointValues(prev_str, str) >= 0) {
+ LOG(ERROR) << StringPrintf("Out-of-order string_ids: '%s' then '%s'", prev_str, str);
+ return false;
+ }
+ }
+
+ ptr_ += sizeof(DexFile::StringId);
+ return true;
+}
+
+bool DexFileVerifier::CheckInterTypeIdItem() {
+ const DexFile::TypeId* item = reinterpret_cast<const DexFile::TypeId*>(ptr_);
+ const char* descriptor = dex_file_->StringDataByIdx(item->descriptor_idx_);
+
+ // Check that the descriptor is a valid type.
+ if (!IsValidDescriptor(descriptor)) {
+ LOG(ERROR) << StringPrintf("Invalid type descriptor: '%s'", descriptor);
+ return false;
+ }
+
+ // Check ordering between items.
+ if (previous_item_ != NULL) {
+ const DexFile::TypeId* prev_item = reinterpret_cast<const DexFile::TypeId*>(previous_item_);
+ if (prev_item->descriptor_idx_ >= item->descriptor_idx_) {
+ LOG(ERROR) << StringPrintf("Out-of-order type_ids: %x then %x", prev_item->descriptor_idx_, item->descriptor_idx_);
+ return false;
+ }
+ }
+
+ ptr_ += sizeof(DexFile::TypeId);
+ return true;
+}
+
+bool DexFileVerifier::CheckInterProtoIdItem() {
+ const DexFile::ProtoId* item = reinterpret_cast<const DexFile::ProtoId*>(ptr_);
+ const char* shorty = dex_file_->StringDataByIdx(item->shorty_idx_);
+ if (item->parameters_off_ != 0 &&
+ !CheckOffsetToTypeMap(item->parameters_off_, DexFile::kDexTypeTypeList)) {
+ return false;
+ }
+
+ // Check the return type and advance the shorty.
+ if (!CheckShortyDescriptorMatch(*shorty, dex_file_->StringByTypeIdx(item->return_type_idx_), true)) {
+ return false;
+ }
+ shorty++;
+
+ DexFileParameterIterator it(*dex_file_, *item);
+ while (it.HasNext() && *shorty != '\0') {
+ const char* descriptor = it.GetDescriptor();
+ if (!CheckShortyDescriptorMatch(*shorty, descriptor, false)) {
+ return false;
+ }
+ it.Next();
+ shorty++;
+ }
+ if (it.HasNext() || *shorty != '\0') {
+ LOG(ERROR) << "Mismatched length for parameters and shorty";
+ return false;
+ }
+
+ // Check ordering between items. This relies on type_ids being in order.
+ if (previous_item_ != NULL) {
+ const DexFile::ProtoId* prev = reinterpret_cast<const DexFile::ProtoId*>(previous_item_);
+ if (prev->return_type_idx_ > item->return_type_idx_) {
+ LOG(ERROR) << "Out-of-order proto_id return types";
+ return false;
+ } else if (prev->return_type_idx_ == item->return_type_idx_) {
+ DexFileParameterIterator curr_it(*dex_file_, *item);
+ DexFileParameterIterator prev_it(*dex_file_, *prev);
+
+ while (curr_it.HasNext() && prev_it.HasNext()) {
+ uint16_t prev_idx = prev_it.GetTypeIdx();
+ uint16_t curr_idx = curr_it.GetTypeIdx();
+ if (prev_idx == DexFile::kDexNoIndex16) {
+ break;
+ }
+ if (curr_idx == DexFile::kDexNoIndex16) {
+ LOG(ERROR) << "Out-of-order proto_id arguments";
+ return false;
+ }
+
+ if (prev_idx < curr_idx) {
+ break;
+ } else if (prev_idx > curr_idx) {
+ LOG(ERROR) << "Out-of-order proto_id arguments";
+ return false;
+ }
+
+ prev_it.Next();
+ curr_it.Next();
+ }
+ }
+ }
+
+ ptr_ += sizeof(DexFile::ProtoId);
+ return true;
+}
+
+bool DexFileVerifier::CheckInterFieldIdItem() {
+ const DexFile::FieldId* item = reinterpret_cast<const DexFile::FieldId*>(ptr_);
+
+ // Check that the class descriptor is valid.
+ const char* descriptor = dex_file_->StringByTypeIdx(item->class_idx_);
+ if (!IsValidDescriptor(descriptor) || descriptor[0] != 'L') {
+ LOG(ERROR) << "Invalid descriptor for class_idx: '" << descriptor << '"';
+ return false;
+ }
+
+ // Check that the type descriptor is a valid field name.
+ descriptor = dex_file_->StringByTypeIdx(item->type_idx_);
+ if (!IsValidDescriptor(descriptor) || descriptor[0] == 'V') {
+ LOG(ERROR) << "Invalid descriptor for type_idx: '" << descriptor << '"';
+ return false;
+ }
+
+ // Check that the name is valid.
+ descriptor = dex_file_->StringDataByIdx(item->name_idx_);
+ if (!IsValidMemberName(descriptor)) {
+ LOG(ERROR) << "Invalid field name: '" << descriptor << '"';
+ return false;
+ }
+
+ // Check ordering between items. This relies on the other sections being in order.
+ if (previous_item_ != NULL) {
+ const DexFile::FieldId* prev_item = reinterpret_cast<const DexFile::FieldId*>(previous_item_);
+ if (prev_item->class_idx_ > item->class_idx_) {
+ LOG(ERROR) << "Out-of-order field_ids";
+ return false;
+ } else if (prev_item->class_idx_ == item->class_idx_) {
+ if (prev_item->name_idx_ > item->name_idx_) {
+ LOG(ERROR) << "Out-of-order field_ids";
+ return false;
+ } else if (prev_item->name_idx_ == item->name_idx_) {
+ if (prev_item->type_idx_ >= item->type_idx_) {
+ LOG(ERROR) << "Out-of-order field_ids";
+ return false;
+ }
+ }
+ }
+ }
+
+ ptr_ += sizeof(DexFile::FieldId);
+ return true;
+}
+
+bool DexFileVerifier::CheckInterMethodIdItem() {
+ const DexFile::MethodId* item = reinterpret_cast<const DexFile::MethodId*>(ptr_);
+
+ // Check that the class descriptor is a valid reference name.
+ const char* descriptor = dex_file_->StringByTypeIdx(item->class_idx_);
+ if (!IsValidDescriptor(descriptor) || (descriptor[0] != 'L' && descriptor[0] != '[')) {
+ LOG(ERROR) << "Invalid descriptor for class_idx: '" << descriptor << '"';
+ return false;
+ }
+
+ // Check that the name is valid.
+ descriptor = dex_file_->StringDataByIdx(item->name_idx_);
+ if (!IsValidMemberName(descriptor)) {
+ LOG(ERROR) << "Invalid method name: '" << descriptor << '"';
+ return false;
+ }
+
+ // Check ordering between items. This relies on the other sections being in order.
+ if (previous_item_ != NULL) {
+ const DexFile::MethodId* prev_item = reinterpret_cast<const DexFile::MethodId*>(previous_item_);
+ if (prev_item->class_idx_ > item->class_idx_) {
+ LOG(ERROR) << "Out-of-order method_ids";
+ return false;
+ } else if (prev_item->class_idx_ == item->class_idx_) {
+ if (prev_item->name_idx_ > item->name_idx_) {
+ LOG(ERROR) << "Out-of-order method_ids";
+ return false;
+ } else if (prev_item->name_idx_ == item->name_idx_) {
+ if (prev_item->proto_idx_ >= item->proto_idx_) {
+ LOG(ERROR) << "Out-of-order method_ids";
+ return false;
+ }
+ }
+ }
+ }
+
+ ptr_ += sizeof(DexFile::MethodId);
+ return true;
+}
+
+bool DexFileVerifier::CheckInterClassDefItem() {
+ const DexFile::ClassDef* item = reinterpret_cast<const DexFile::ClassDef*>(ptr_);
+ uint32_t class_idx = item->class_idx_;
+ const char* descriptor = dex_file_->StringByTypeIdx(class_idx);
+
+ if (!IsValidDescriptor(descriptor) || descriptor[0] != 'L') {
+ LOG(ERROR) << "Invalid class descriptor: '" << descriptor << "'";
+ return false;
+ }
+
+ if (item->interfaces_off_ != 0 &&
+ !CheckOffsetToTypeMap(item->interfaces_off_, DexFile::kDexTypeTypeList)) {
+ return false;
+ }
+ if (item->annotations_off_ != 0 &&
+ !CheckOffsetToTypeMap(item->annotations_off_, DexFile::kDexTypeAnnotationsDirectoryItem)) {
+ return false;
+ }
+ if (item->class_data_off_ != 0 &&
+ !CheckOffsetToTypeMap(item->class_data_off_, DexFile::kDexTypeClassDataItem)) {
+ return false;
+ }
+ if (item->static_values_off_ != 0 &&
+ !CheckOffsetToTypeMap(item->static_values_off_, DexFile::kDexTypeEncodedArrayItem)) {
+ return false;
+ }
+
+ if (item->superclass_idx_ != DexFile::kDexNoIndex16) {
+ descriptor = dex_file_->StringByTypeIdx(item->superclass_idx_);
+ if (!IsValidDescriptor(descriptor) || descriptor[0] != 'L') {
+ LOG(ERROR) << "Invalid superclass: '" << descriptor << "'";
+ return false;
+ }
+ }
+
+ const DexFile::TypeList* interfaces = dex_file_->GetInterfacesList(*item);
+ if (interfaces != NULL) {
+ uint32_t size = interfaces->Size();
+
+ // Ensure that all interfaces refer to classes (not arrays or primitives).
+ for (uint32_t i = 0; i < size; i++) {
+ descriptor = dex_file_->StringByTypeIdx(interfaces->GetTypeItem(i).type_idx_);
+ if (!IsValidDescriptor(descriptor) || descriptor[0] != 'L') {
+ LOG(ERROR) << "Invalid interface: '" << descriptor << "'";
+ return false;
+ }
+ }
+
+ /*
+ * Ensure that there are no duplicates. This is an O(N^2) test, but in
+ * practice the number of interfaces implemented by any given class is low.
+ */
+ for (uint32_t i = 1; i < size; i++) {
+ uint32_t idx1 = interfaces->GetTypeItem(i).type_idx_;
+ for (uint32_t j =0; j < i; j++) {
+ uint32_t idx2 = interfaces->GetTypeItem(j).type_idx_;
+ if (idx1 == idx2) {
+ LOG(ERROR) << "Duplicate interface: '" << dex_file_->StringByTypeIdx(idx1) << "'";
+ return false;
+ }
+ }
+ }
+ }
+
+ // Check that references in class_data_item are to the right class.
+ if (item->class_data_off_ != 0) {
+ const byte* data = base_ + item->class_data_off_;
+ uint16_t data_definer = FindFirstClassDataDefiner(data);
+ if ((data_definer != item->class_idx_) && (data_definer != DexFile::kDexNoIndex16)) {
+ LOG(ERROR) << "Invalid class_data_item";
+ return false;
+ }
+ }
+
+ // Check that references in annotations_directory_item are to right class.
+ if (item->annotations_off_ != 0) {
+ const byte* data = base_ + item->annotations_off_;
+ uint16_t annotations_definer = FindFirstAnnotationsDirectoryDefiner(data);
+ if ((annotations_definer != item->class_idx_) && (annotations_definer != DexFile::kDexNoIndex16)) {
+ LOG(ERROR) << "Invalid annotations_directory_item";
+ return false;
+ }
+ }
+
+ ptr_ += sizeof(DexFile::ClassDef);
+ return true;
+}
+
+bool DexFileVerifier::CheckInterAnnotationSetRefList() {
+ const DexFile::AnnotationSetRefList* list =
+ reinterpret_cast<const DexFile::AnnotationSetRefList*>(ptr_);
+ const DexFile::AnnotationSetRefItem* item = list->list_;
+ uint32_t count = list->size_;
+
+ while (count--) {
+ if (item->annotations_off_ != 0 &&
+ !CheckOffsetToTypeMap(item->annotations_off_, DexFile::kDexTypeAnnotationSetItem)) {
+ return false;
+ }
+ item++;
+ }
+
+ ptr_ = reinterpret_cast<const byte*>(item);
+ return true;
+}
+
+bool DexFileVerifier::CheckInterAnnotationSetItem() {
+ const DexFile::AnnotationSetItem* set = reinterpret_cast<const DexFile::AnnotationSetItem*>(ptr_);
+ const uint32_t* offsets = set->entries_;
+ uint32_t count = set->size_;
+ uint32_t last_idx = 0;
+
+ for (uint32_t i = 0; i < count; i++) {
+ if (*offsets != 0 && !CheckOffsetToTypeMap(*offsets, DexFile::kDexTypeAnnotationItem)) {
+ return false;
+ }
+
+ // Get the annotation from the offset and the type index for the annotation.
+ const DexFile::AnnotationItem* annotation =
+ reinterpret_cast<const DexFile::AnnotationItem*>(base_ + *offsets);
+ const uint8_t* data = annotation->annotation_;
+ uint32_t idx = DecodeUnsignedLeb128(&data);
+
+ if (last_idx >= idx && i != 0) {
+ LOG(ERROR) << StringPrintf("Out-of-order entry types: %x then %x", last_idx, idx);
+ return false;
+ }
+
+ last_idx = idx;
+ offsets++;
+ }
+
+ ptr_ = reinterpret_cast<const byte*>(offsets);
+ return true;
+}
+
+bool DexFileVerifier::CheckInterClassDataItem() {
+ ClassDataItemIterator it(*dex_file_, ptr_);
+ uint16_t defining_class = FindFirstClassDataDefiner(ptr_);
+
+ for (; it.HasNextStaticField() || it.HasNextInstanceField(); it.Next()) {
+ const DexFile::FieldId& field = dex_file_->GetFieldId(it.GetMemberIndex());
+ if (field.class_idx_ != defining_class) {
+ LOG(ERROR) << "Mismatched defining class for class_data_item field";
+ return false;
+ }
+ }
+ for (; it.HasNextDirectMethod() || it.HasNextVirtualMethod(); it.Next()) {
+ uint32_t code_off = it.GetMethodCodeItemOffset();
+ if (code_off != 0 && !CheckOffsetToTypeMap(code_off, DexFile::kDexTypeCodeItem)) {
+ return false;
+ }
+ const DexFile::MethodId& method = dex_file_->GetMethodId(it.GetMemberIndex());
+ if (method.class_idx_ != defining_class) {
+ LOG(ERROR) << "Mismatched defining class for class_data_item method";
+ return false;
+ }
+ }
+
+ ptr_ = it.EndDataPointer();
+ return true;
+}
+
+bool DexFileVerifier::CheckInterAnnotationsDirectoryItem() {
+ const DexFile::AnnotationsDirectoryItem* item =
+ reinterpret_cast<const DexFile::AnnotationsDirectoryItem*>(ptr_);
+ uint16_t defining_class = FindFirstAnnotationsDirectoryDefiner(ptr_);
+
+ if (item->class_annotations_off_ != 0 &&
+ !CheckOffsetToTypeMap(item->class_annotations_off_, DexFile::kDexTypeAnnotationSetItem)) {
+ return false;
+ }
+
+ // Field annotations follow immediately after the annotations directory.
+ const DexFile::FieldAnnotationsItem* field_item =
+ reinterpret_cast<const DexFile::FieldAnnotationsItem*>(item + 1);
+ uint32_t field_count = item->fields_size_;
+ for (uint32_t i = 0; i < field_count; i++) {
+ const DexFile::FieldId& field = dex_file_->GetFieldId(field_item->field_idx_);
+ if (field.class_idx_ != defining_class) {
+ LOG(ERROR) << "Mismatched defining class for field_annotation";
+ return false;
+ }
+ if (!CheckOffsetToTypeMap(field_item->annotations_off_, DexFile::kDexTypeAnnotationSetItem)) {
+ return false;
+ }
+ field_item++;
+ }
+
+ // Method annotations follow immediately after field annotations.
+ const DexFile::MethodAnnotationsItem* method_item =
+ reinterpret_cast<const DexFile::MethodAnnotationsItem*>(field_item);
+ uint32_t method_count = item->methods_size_;
+ for (uint32_t i = 0; i < method_count; i++) {
+ const DexFile::MethodId& method = dex_file_->GetMethodId(method_item->method_idx_);
+ if (method.class_idx_ != defining_class) {
+ LOG(ERROR) << "Mismatched defining class for method_annotation";
+ return false;
+ }
+ if (!CheckOffsetToTypeMap(method_item->annotations_off_, DexFile::kDexTypeAnnotationSetItem)) {
+ return false;
+ }
+ method_item++;
+ }
+
+ // Parameter annotations follow immediately after method annotations.
+ const DexFile::ParameterAnnotationsItem* parameter_item =
+ reinterpret_cast<const DexFile::ParameterAnnotationsItem*>(method_item);
+ uint32_t parameter_count = item->parameters_size_;
+ for (uint32_t i = 0; i < parameter_count; i++) {
+ const DexFile::MethodId& parameter_method = dex_file_->GetMethodId(parameter_item->method_idx_);
+ if (parameter_method.class_idx_ != defining_class) {
+ LOG(ERROR) << "Mismatched defining class for parameter_annotation";
+ return false;
+ }
+ if (!CheckOffsetToTypeMap(parameter_item->annotations_off_, DexFile::kDexTypeAnnotationSetRefList)) {
+ return false;
+ }
+ parameter_item++;
+ }
+
+ ptr_ = reinterpret_cast<const byte*>(parameter_item);
+ return true;
+}
+
+bool DexFileVerifier::CheckInterSectionIterate(uint32_t offset, uint32_t count, uint16_t type) {
+ // Get the right alignment mask for the type of section.
+ uint32_t alignment_mask;
+ switch (type) {
+ case DexFile::kDexTypeClassDataItem:
+ alignment_mask = sizeof(uint8_t) - 1;
+ break;
+ default:
+ alignment_mask = sizeof(uint32_t) - 1;
+ break;
+ }
+
+ // Iterate through the items in the section.
+ previous_item_ = NULL;
+ for (uint32_t i = 0; i < count; i++) {
+ uint32_t new_offset = (offset + alignment_mask) & ~alignment_mask;
+ ptr_ = base_ + new_offset;
+ const byte* prev_ptr = ptr_;
+
+ // Check depending on the section type.
+ switch (type) {
+ case DexFile::kDexTypeStringIdItem: {
+ if (!CheckInterStringIdItem()) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexTypeTypeIdItem: {
+ if (!CheckInterTypeIdItem()) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexTypeProtoIdItem: {
+ if (!CheckInterProtoIdItem()) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexTypeFieldIdItem: {
+ if (!CheckInterFieldIdItem()) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexTypeMethodIdItem: {
+ if (!CheckInterMethodIdItem()) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexTypeClassDefItem: {
+ if (!CheckInterClassDefItem()) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexTypeAnnotationSetRefList: {
+ if (!CheckInterAnnotationSetRefList()) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexTypeAnnotationSetItem: {
+ if (!CheckInterAnnotationSetItem()) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexTypeClassDataItem: {
+ if (!CheckInterClassDataItem()) {
+ return false;
+ }
+ break;
+ }
+ case DexFile::kDexTypeAnnotationsDirectoryItem: {
+ if (!CheckInterAnnotationsDirectoryItem()) {
+ return false;
+ }
+ break;
+ }
+ default:
+ LOG(ERROR) << StringPrintf("Unknown map item type %x", type);
+ return false;
+ }
+
+ previous_item_ = prev_ptr;
+ offset = reinterpret_cast<uint32_t>(ptr_) - reinterpret_cast<uint32_t>(base_);
+ }
+
+ return true;
+}
+
+bool DexFileVerifier::CheckInterSection() {
+ const DexFile::MapList* map = reinterpret_cast<const DexFile::MapList*>(base_ + header_->map_off_);
+ const DexFile::MapItem* item = map->list_;
+ uint32_t count = map->size_;
+
+ // Cross check the items listed in the map.
+ while (count--) {
+ uint32_t section_offset = item->offset_;
+ uint32_t section_count = item->size_;
+ uint16_t type = item->type_;
+
+ switch (type) {
+ case DexFile::kDexTypeHeaderItem:
+ case DexFile::kDexTypeMapList:
+ case DexFile::kDexTypeTypeList:
+ case DexFile::kDexTypeCodeItem:
+ case DexFile::kDexTypeStringDataItem:
+ case DexFile::kDexTypeDebugInfoItem:
+ case DexFile::kDexTypeAnnotationItem:
+ case DexFile::kDexTypeEncodedArrayItem:
+ break;
+ case DexFile::kDexTypeStringIdItem:
+ case DexFile::kDexTypeTypeIdItem:
+ case DexFile::kDexTypeProtoIdItem:
+ case DexFile::kDexTypeFieldIdItem:
+ case DexFile::kDexTypeMethodIdItem:
+ case DexFile::kDexTypeClassDefItem:
+ case DexFile::kDexTypeAnnotationSetRefList:
+ case DexFile::kDexTypeAnnotationSetItem:
+ case DexFile::kDexTypeClassDataItem:
+ case DexFile::kDexTypeAnnotationsDirectoryItem: {
+ if (!CheckInterSectionIterate(section_offset, section_count, type)) {
+ return false;
+ }
+ break;
+ }
+ default:
+ LOG(ERROR) << StringPrintf("Unknown map item type %x", type);
+ return false;
+ }
+
+ item++;
+ }
+
+ return true;
+}
+
+bool DexFileVerifier::Verify() {
+ // Check the header.
+ if (!CheckHeader()) {
+ return false;
+ }
+
+ // Check the map section.
+ if (!CheckMap()) {
+ return false;
+ }
+
+ // Check structure within remaining sections.
+ if (!CheckIntraSection()) {
+ return false;
+ }
+
+ // Check references from one section to another.
+ if (!CheckInterSection()) {
+ return false;
+ }
+
+ return true;
+}
+
+} // namespace art
diff --git a/src/dex_file_verifier.h b/src/dex_file_verifier.h
new file mode 100644
index 0000000..6b8fcf4
--- /dev/null
+++ b/src/dex_file_verifier.h
@@ -0,0 +1,84 @@
+// Copyright 2011 Google Inc. All Rights Reserved.
+
+#ifndef ART_SRC_DEX_FILE_VERIFIER_H_
+#define ART_SRC_DEX_FILE_VERIFIER_H_
+
+#include <map>
+
+#include "dex_file.h"
+
+namespace art {
+
+class DexFileVerifier {
+ public:
+ static bool Verify(DexFile* dex_file, const byte* base, size_t length);
+
+ private:
+ DexFileVerifier(DexFile* dex_file, const byte* base, size_t length)
+ : dex_file_(dex_file), base_(base), length_(length),
+ header_(&dex_file->GetHeader()), ptr_(NULL), previous_item_(NULL) {
+ }
+
+ bool Verify();
+
+ bool CheckPointerRange(const void* start, const void* end, const char* label) const;
+ bool CheckListSize(const void* start, uint32_t count, uint32_t element_size, const char* label) const;
+ bool CheckIndex(uint32_t field, uint32_t limit, const char* label) const;
+
+ bool CheckHeader() const;
+ bool CheckMap() const;
+
+ uint32_t ReadUnsignedLittleEndian(uint32_t size);
+ bool CheckAndGetHandlerOffsets(const DexFile::CodeItem* code_item,
+ uint32_t* handler_offsets, uint32_t handlers_size);
+ bool CheckClassDataItemField(uint32_t idx, uint32_t access_flags, bool expect_static) const;
+ bool CheckClassDataItemMethod(uint32_t idx, uint32_t access_flags, uint32_t code_offset,
+ bool expect_direct) const;
+ bool CheckPadding(uint32_t offset, uint32_t aligned_offset);
+ bool CheckEncodedValue();
+ bool CheckEncodedArray();
+ bool CheckEncodedAnnotation();
+
+ bool CheckIntraClassDataItem();
+ bool CheckIntraCodeItem();
+ bool CheckIntraStringDataItem();
+ bool CheckIntraDebugInfoItem();
+ bool CheckIntraAnnotationItem();
+ bool CheckIntraAnnotationsDirectoryItem();
+
+ bool CheckIntraSectionIterate(uint32_t offset, uint32_t count, uint16_t type);
+ bool CheckIntraIdSection(uint32_t offset, uint32_t count, uint16_t type);
+ bool CheckIntraDataSection(uint32_t offset, uint32_t count, uint16_t type);
+ bool CheckIntraSection();
+
+ bool CheckOffsetToTypeMap(uint32_t offset, uint16_t type);
+ uint16_t FindFirstClassDataDefiner(const byte* ptr) const;
+ uint16_t FindFirstAnnotationsDirectoryDefiner(const byte* ptr) const;
+
+ bool CheckInterStringIdItem();
+ bool CheckInterTypeIdItem();
+ bool CheckInterProtoIdItem();
+ bool CheckInterFieldIdItem();
+ bool CheckInterMethodIdItem();
+ bool CheckInterClassDefItem();
+ bool CheckInterAnnotationSetRefList();
+ bool CheckInterAnnotationSetItem();
+ bool CheckInterClassDataItem();
+ bool CheckInterAnnotationsDirectoryItem();
+
+ bool CheckInterSectionIterate(uint32_t offset, uint32_t count, uint16_t type);
+ bool CheckInterSection();
+
+ DexFile* dex_file_;
+ const byte* base_;
+ size_t length_;
+ const DexFile::Header* header_;
+
+ std::map<uint32_t, uint16_t> offset_to_type_map_;
+ const byte* ptr_;
+ const void* previous_item_;
+};
+
+} // namespace art
+
+#endif // ART_SRC_DEX_FILE_VERIFIER_H_
diff --git a/src/image_test.cc b/src/image_test.cc
index 6901482..57afe68 100644
--- a/src/image_test.cc
+++ b/src/image_test.cc
@@ -18,7 +18,8 @@
TEST_F(ImageTest, WriteRead) {
ScratchFile tmp_oat;
- bool success_oat = OatWriter::Create(tmp_oat.GetFile(), NULL, *compiler_.get());
+ std::vector<const DexFile*> dex_files;
+ bool success_oat = OatWriter::Create(tmp_oat.GetFile(), NULL, dex_files, *compiler_.get());
ASSERT_TRUE(success_oat);
// Force all system classes into memory
diff --git a/src/oat_test.cc b/src/oat_test.cc
index e4af31e..5201bea 100644
--- a/src/oat_test.cc
+++ b/src/oat_test.cc
@@ -20,7 +20,7 @@
}
ScratchFile tmp;
- bool success = OatWriter::Create(tmp.GetFile(), class_loader.get(), *compiler_.get());
+ bool success = OatWriter::Create(tmp.GetFile(), class_loader.get(), class_linker->GetBootClassPath(), *compiler_.get());
ASSERT_TRUE(success);
if (compile) { // OatWriter strips the code, regenerate to compare
diff --git a/src/oat_writer.cc b/src/oat_writer.cc
index 498ab34..b8dc14b 100644
--- a/src/oat_writer.cc
+++ b/src/oat_writer.cc
@@ -12,8 +12,8 @@
bool OatWriter::Create(File* file,
const ClassLoader* class_loader,
+ const std::vector<const DexFile*>& dex_files,
const Compiler& compiler) {
- const std::vector<const DexFile*>& dex_files = ClassLoader::GetCompileTimeClassPath(class_loader);
OatWriter oat_writer(dex_files, class_loader, compiler);
return oat_writer.Write(file);
}
diff --git a/src/oat_writer.h b/src/oat_writer.h
index a9ea7ef..33dcf0e 100644
--- a/src/oat_writer.h
+++ b/src/oat_writer.h
@@ -49,7 +49,8 @@
class OatWriter {
public:
// Write an oat file. Returns true on success, false on failure.
- static bool Create(File* file, const ClassLoader* class_loader, const Compiler& compiler);
+ static bool Create(File* file, const ClassLoader* class_loader,
+ const std::vector<const DexFile*>& dex_files, const Compiler& compiler);
private:
diff --git a/src/utf.cc b/src/utf.cc
index 52f03a9..14f511c 100644
--- a/src/utf.cc
+++ b/src/utf.cc
@@ -89,13 +89,16 @@
int CompareModifiedUtf8ToModifiedUtf8AsUtf16CodePointValues(const char* utf8_1, const char* utf8_2) {
for (;;) {
- uint16_t c1 = GetUtf16FromUtf8(&utf8_1);
- uint16_t c2 = GetUtf16FromUtf8(&utf8_2);
- if (c1 == 0) {
- return (c2 == 0) ? 0 : -1;
- } else if (c2 == 0) {
+ if (*utf8_1 == '\0') {
+ return (*utf8_2 == '\0') ? 0 : -1;
+ } else if (*utf8_2 == '\0') {
return 1;
- } else if (c1 != c2) {
+ }
+
+ int c1 = GetUtf16FromUtf8(&utf8_1);
+ int c2 = GetUtf16FromUtf8(&utf8_2);
+
+ if (c1 != c2) {
return c1 > c2 ? 1 : -1;
}
}
diff --git a/src/utils.cc b/src/utils.cc
index c0be9b4..dbbca28 100644
--- a/src/utils.cc
+++ b/src/utils.cc
@@ -349,7 +349,7 @@
return long_name;
}
-// Helper for IsValidMemberNameUtf8(), a bit vector indicating valid low ascii.
+// Helper for IsValidPartOfMemberNameUtf8(), a bit vector indicating valid low ascii.
uint32_t DEX_MEMBER_VALID_LOW_ASCII[4] = {
0x00000000, // 00..1f low control characters; nothing valid
0x03ff2010, // 20..3f digits and symbols; valid: '0'..'9', '$', '-'
@@ -357,8 +357,8 @@
0x07fffffe // 60..7f lowercase etc.; valid: 'a'..'z'
};
-// Helper for IsValidMemberNameUtf8(); do not call directly.
-bool IsValidMemberNameUtf8Slow(const char** pUtf8Ptr) {
+// Helper for IsValidPartOfMemberNameUtf8(); do not call directly.
+bool IsValidPartOfMemberNameUtf8Slow(const char** pUtf8Ptr) {
/*
* It's a multibyte encoded character. Decode it and analyze. We
* accept anything that isn't (a) an improperly encoded low value,
@@ -413,7 +413,7 @@
* this function returns false, then the given pointer may only have
* been partially advanced.
*/
-bool IsValidMemberNameUtf8(const char** pUtf8Ptr) {
+bool IsValidPartOfMemberNameUtf8(const char** pUtf8Ptr) {
uint8_t c = (uint8_t) **pUtf8Ptr;
if (c <= 0x7f) {
// It's low-ascii, so check the table.
@@ -425,7 +425,34 @@
// It's a multibyte encoded character. Call a non-inline function
// for the heavy lifting.
- return IsValidMemberNameUtf8Slow(pUtf8Ptr);
+ return IsValidPartOfMemberNameUtf8Slow(pUtf8Ptr);
+}
+
+bool IsValidMemberName(const char* s) {
+ bool angle_name = false;
+
+ switch(*s) {
+ case '\0':
+ // The empty string is not a valid name.
+ return false;
+ case '<':
+ angle_name = true;
+ s++;
+ break;
+ }
+
+ while (true) {
+ switch (*s) {
+ case '\0':
+ return !angle_name;
+ case '>':
+ return angle_name && s[1] == '\0';
+ }
+
+ if (!IsValidPartOfMemberNameUtf8(&s)) {
+ return false;
+ }
+ }
}
enum ClassNameType { kName, kDescriptor };
@@ -521,7 +548,7 @@
s++;
break;
default:
- if (!IsValidMemberNameUtf8(&s)) {
+ if (!IsValidPartOfMemberNameUtf8(&s)) {
return false;
}
sepOrFirst = false;
diff --git a/src/utils.h b/src/utils.h
index 606f35d..6a18138 100644
--- a/src/utils.h
+++ b/src/utils.h
@@ -198,6 +198,10 @@
bool IsValidJniClassName(const char* s); // "java/lang/String"
bool IsValidDescriptor(const char* s); // "Ljava/lang/String;"
+// Returns whether the given string is a valid field or method name,
+// additionally allowing names that begin with '<' and end with '>'.
+bool IsValidMemberName(const char* s);
+
// Returns the JNI native function name for the non-overloaded method 'm'.
std::string JniShortName(const Method* m);
// Returns the JNI native function name for the overloaded method 'm'.