Add check that map offset is sane to DexFile object init.
The DexFile constructor calls InitializeSectionsFromMapList, which
uses the header's map_offset before any checks are done on the file.
Bug: 37235346
Test: mm test-art-host-gtest-dex_file_test
Change-Id: I4fb8fcb57f9ef7e0182965b7ce663424b953abcb
diff --git a/runtime/dex_file.cc b/runtime/dex_file.cc
index 85100ae..688f95b 100644
--- a/runtime/dex_file.cc
+++ b/runtime/dex_file.cc
@@ -590,6 +590,10 @@
void DexFile::InitializeSectionsFromMapList() {
const MapList* map_list = reinterpret_cast<const MapList*>(begin_ + header_->map_off_);
+ if (header_->map_off_ == 0 || header_->map_off_ > size_) {
+ // Bad offset. The dex file verifier runs after this method and will reject the file.
+ return;
+ }
const size_t count = map_list->size_;
size_t map_limit = header_->map_off_ + count * sizeof(MapItem);