12faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes/* 22faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * Copyright (C) 2011 The Android Open Source Project 32faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * 42faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * Licensed under the Apache License, Version 2.0 (the "License"); 52faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * you may not use this file except in compliance with the License. 62faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * You may obtain a copy of the License at 72faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * 82faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * http://www.apache.org/licenses/LICENSE-2.0 92faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * 102faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * Unless required by applicable law or agreed to in writing, software 112faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * distributed under the License is distributed on an "AS IS" BASIS, 122faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 132faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * See the License for the specific language governing permissions and 142faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * limitations under the License. 152faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes */ 1610037c866b04550fc5461058c398c2e3e509381ajeffhao 1710037c866b04550fc5461058c398c2e3e509381ajeffhao#include "dex_file_verifier.h" 1810037c866b04550fc5461058c398c2e3e509381ajeffhao 19e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe#include <inttypes.h> 2092572be7f754c213e615a62955cc5f65ca8c0c0eNarayan Kamath#include <zlib.h> 21e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 22700a402244a1a423da4f3ba8032459f4b65fa18fIan Rogers#include <memory> 2392572be7f754c213e615a62955cc5f65ca8c0c0eNarayan Kamath 24e222ee0b794f941af4fb1b32fb8224e32942ea7bElliott Hughes#include "base/stringprintf.h" 254f6ad8ab428038129b2d0d6c40b7fd625cca15e1Ian Rogers#include "dex_file-inl.h" 26eb7c144a6aff7da673ba53d501c46f00311d4d7fAlex Light#include "experimental_flags.h" 2710037c866b04550fc5461058c398c2e3e509381ajeffhao#include "leb128.h" 28eb7c144a6aff7da673ba53d501c46f00311d4d7fAlex Light#include "runtime.h" 29a0e180632411f7fe0edf454e571c42209ee7b540Elliott Hughes#include "safe_map.h" 30a67249065e4c9b3cf4a7c081d95a78df28291ee9Ian Rogers#include "utf-inl.h" 312dd0e2cea360bc9206eb88ecc40d259e796c239dIan Rogers#include "utils.h" 3210037c866b04550fc5461058c398c2e3e509381ajeffhao 3310037c866b04550fc5461058c398c2e3e509381ajeffhaonamespace art { 3410037c866b04550fc5461058c398c2e3e509381ajeffhao 3510037c866b04550fc5461058c398c2e3e509381ajeffhaostatic uint32_t MapTypeToBitMask(uint32_t map_type) { 3610037c866b04550fc5461058c398c2e3e509381ajeffhao switch (map_type) { 3710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: return 1 << 0; 3810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: return 1 << 1; 3910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: return 1 << 2; 4010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: return 1 << 3; 4110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: return 1 << 4; 4210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: return 1 << 5; 4310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: return 1 << 6; 4410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMapList: return 1 << 7; 4510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: return 1 << 8; 4610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: return 1 << 9; 4710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: return 1 << 10; 4810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: return 1 << 11; 4910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: return 1 << 12; 5010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: return 1 << 13; 5110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: return 1 << 14; 5210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: return 1 << 15; 5310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: return 1 << 16; 5410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: return 1 << 17; 5510037c866b04550fc5461058c398c2e3e509381ajeffhao } 5610037c866b04550fc5461058c398c2e3e509381ajeffhao return 0; 5710037c866b04550fc5461058c398c2e3e509381ajeffhao} 5810037c866b04550fc5461058c398c2e3e509381ajeffhao 5910037c866b04550fc5461058c398c2e3e509381ajeffhaostatic bool IsDataSectionType(uint32_t map_type) { 6010037c866b04550fc5461058c398c2e3e509381ajeffhao switch (map_type) { 6110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: 6210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 6310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 6410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 6510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 6610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 6710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 6810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 6910037c866b04550fc5461058c398c2e3e509381ajeffhao } 7010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 7110037c866b04550fc5461058c398c2e3e509381ajeffhao} 7210037c866b04550fc5461058c398c2e3e509381ajeffhao 73e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampeconst char* DexFileVerifier::CheckLoadStringByIdx(uint32_t idx, const char* error_string) { 74df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(!CheckIndex(idx, dex_file_->NumStringIds(), error_string))) { 75e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return nullptr; 76e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 77e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return dex_file_->StringDataByIdx(idx); 78e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe} 79e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 80e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampeconst char* DexFileVerifier::CheckLoadStringByTypeIdx(uint32_t type_idx, const char* error_string) { 81df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(!CheckIndex(type_idx, dex_file_->NumTypeIds(), error_string))) { 82e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return nullptr; 83e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 84e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe const DexFile::TypeId& type_id = dex_file_->GetTypeId(type_idx); 85e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe uint32_t idx = type_id.descriptor_idx_; 86e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return CheckLoadStringByIdx(idx, error_string); 87e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe} 88e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 89e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampeconst DexFile::FieldId* DexFileVerifier::CheckLoadFieldId(uint32_t idx, const char* error_string) { 90df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(!CheckIndex(idx, dex_file_->NumFieldIds(), error_string))) { 91e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return nullptr; 92e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 93e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return &dex_file_->GetFieldId(idx); 94e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe} 95e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 96e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampeconst DexFile::MethodId* DexFileVerifier::CheckLoadMethodId(uint32_t idx, const char* err_string) { 97df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(!CheckIndex(idx, dex_file_->NumMethodIds(), err_string))) { 98e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return nullptr; 99e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 100e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return &dex_file_->GetMethodId(idx); 101e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe} 102e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 103e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe// Helper macro to load string and return false on error. 104e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe#define LOAD_STRING(var, idx, error) \ 105e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe const char* var = CheckLoadStringByIdx(idx, error); \ 106df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(var == nullptr)) { \ 107e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; \ 108e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 109e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 110e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe// Helper macro to load string by type idx and return false on error. 111e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe#define LOAD_STRING_BY_TYPE(var, type_idx, error) \ 112e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe const char* var = CheckLoadStringByTypeIdx(type_idx, error); \ 113df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(var == nullptr)) { \ 114e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; \ 115e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 116e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 117e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe// Helper macro to load method id. Return last parameter on error. 1185e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe#define LOAD_METHOD(var, idx, error_string, error_stmt) \ 119e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe const DexFile::MethodId* var = CheckLoadMethodId(idx, error_string); \ 120df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(var == nullptr)) { \ 1215e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe error_stmt; \ 122e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 123e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 124e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe// Helper macro to load method id. Return last parameter on error. 1255e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe#define LOAD_FIELD(var, idx, fmt, error_stmt) \ 126e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe const DexFile::FieldId* var = CheckLoadFieldId(idx, fmt); \ 127df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(var == nullptr)) { \ 1285e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe error_stmt; \ 129e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 130e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 13113735955f39b3b304c37d2b2840663c131262c18Ian Rogersbool DexFileVerifier::Verify(const DexFile* dex_file, const uint8_t* begin, size_t size, 1328d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers const char* location, std::string* error_msg) { 133700a402244a1a423da4f3ba8032459f4b65fa18fIan Rogers std::unique_ptr<DexFileVerifier> verifier(new DexFileVerifier(dex_file, begin, size, location)); 1348d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (!verifier->Verify()) { 1358d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers *error_msg = verifier->FailureReason(); 1368d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers return false; 1378d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } 1388d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers return true; 1398d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers} 1408d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers 1418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckShortyDescriptorMatch(char shorty_char, const char* descriptor, 1428d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers bool is_return_type) { 14310037c866b04550fc5461058c398c2e3e509381ajeffhao switch (shorty_char) { 14410037c866b04550fc5461058c398c2e3e509381ajeffhao case 'V': 1458d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!is_return_type)) { 1468d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid use of void"); 14710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 14810037c866b04550fc5461058c398c2e3e509381ajeffhao } 149fc787ecd91127b2c8458afd94e5148e2ae51a1f5Ian Rogers FALLTHROUGH_INTENDED; 15010037c866b04550fc5461058c398c2e3e509381ajeffhao case 'B': 15110037c866b04550fc5461058c398c2e3e509381ajeffhao case 'C': 15210037c866b04550fc5461058c398c2e3e509381ajeffhao case 'D': 15310037c866b04550fc5461058c398c2e3e509381ajeffhao case 'F': 15410037c866b04550fc5461058c398c2e3e509381ajeffhao case 'I': 15510037c866b04550fc5461058c398c2e3e509381ajeffhao case 'J': 15610037c866b04550fc5461058c398c2e3e509381ajeffhao case 'S': 15710037c866b04550fc5461058c398c2e3e509381ajeffhao case 'Z': 1588d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((descriptor[0] != shorty_char) || (descriptor[1] != '\0'))) { 1598d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Shorty vs. primitive type mismatch: '%c', '%s'", 1608d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers shorty_char, descriptor); 16110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 16210037c866b04550fc5461058c398c2e3e509381ajeffhao } 16310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 16410037c866b04550fc5461058c398c2e3e509381ajeffhao case 'L': 1658d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((descriptor[0] != 'L') && (descriptor[0] != '['))) { 1668d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Shorty vs. type mismatch: '%c', '%s'", shorty_char, descriptor); 16710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 16810037c866b04550fc5461058c398c2e3e509381ajeffhao } 16910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 17010037c866b04550fc5461058c398c2e3e509381ajeffhao default: 1718d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad shorty character: '%c'", shorty_char); 17210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 17310037c866b04550fc5461058c398c2e3e509381ajeffhao } 17410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 17510037c866b04550fc5461058c398c2e3e509381ajeffhao} 17610037c866b04550fc5461058c398c2e3e509381ajeffhao 17750d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampebool DexFileVerifier::CheckListSize(const void* start, size_t count, size_t elem_size, 178d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe const char* label) { 17950d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe // Check that size is not 0. 18050d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe CHECK_NE(elem_size, 0U); 18150d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe 18213735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* range_start = reinterpret_cast<const uint8_t*>(start); 18313735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* file_start = reinterpret_cast<const uint8_t*>(begin_); 18450d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe 18550d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe // Check for overflow. 18650d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe uintptr_t max = 0 - 1; 18750d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe size_t available_bytes_till_end_of_mem = max - reinterpret_cast<uintptr_t>(start); 18850d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe size_t max_count = available_bytes_till_end_of_mem / elem_size; 18950d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (max_count < count) { 19050d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe ErrorStringPrintf("Overflow in range for %s: %zx for %zu@%zu", label, 19150d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe static_cast<size_t>(range_start - file_start), 19250d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe count, elem_size); 19350d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe return false; 19450d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe } 19550d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe 19613735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* range_end = range_start + count * elem_size; 19713735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* file_end = file_start + size_; 19850d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (UNLIKELY((range_start < file_start) || (range_end > file_end))) { 19950d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe // Note: these two tests are enough as we make sure above that there's no overflow. 2008a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Bad range for %s: %zx to %zx", label, 201e3d5581266301e6a672af6233220037abf52fea1Ian Rogers static_cast<size_t>(range_start - file_start), 202e3d5581266301e6a672af6233220037abf52fea1Ian Rogers static_cast<size_t>(range_end - file_start)); 20310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 20410037c866b04550fc5461058c398c2e3e509381ajeffhao } 20510037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 20610037c866b04550fc5461058c398c2e3e509381ajeffhao} 20710037c866b04550fc5461058c398c2e3e509381ajeffhao 20813735955f39b3b304c37d2b2840663c131262c18Ian Rogersbool DexFileVerifier::CheckList(size_t element_size, const char* label, const uint8_t* *ptr) { 209d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe // Check that the list is available. The first 4B are the count. 210d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckListSize(*ptr, 1, 4U, label)) { 211d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return false; 212d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 213d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 214d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe uint32_t count = *reinterpret_cast<const uint32_t*>(*ptr); 215d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (count > 0) { 216d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckListSize(*ptr + 4, count, element_size, label)) { 217d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return false; 218d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 219d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 220d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 221d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe *ptr += 4 + count * element_size; 222d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return true; 223d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe} 224d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 2258d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckIndex(uint32_t field, uint32_t limit, const char* label) { 2268d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(field >= limit)) { 2278d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad index for %s: %x >= %x", label, field, limit); 22810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 22910037c866b04550fc5461058c398c2e3e509381ajeffhao } 23010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 23110037c866b04550fc5461058c398c2e3e509381ajeffhao} 23210037c866b04550fc5461058c398c2e3e509381ajeffhao 233b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampebool DexFileVerifier::CheckValidOffsetAndSize(uint32_t offset, 234b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe uint32_t size, 235b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe size_t alignment, 236b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe const char* label) { 237d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (size == 0) { 238d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (offset != 0) { 239d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe ErrorStringPrintf("Offset(%d) should be zero when size is zero for %s.", offset, label); 240d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return false; 241d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 242d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 243d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (size_ <= offset) { 244d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe ErrorStringPrintf("Offset(%d) should be within file size(%zu) for %s.", offset, size_, label); 245d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return false; 246d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 247b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe if (alignment != 0 && !IsAlignedParam(offset, alignment)) { 248b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe ErrorStringPrintf("Offset(%d) should be aligned by %zu for %s.", offset, alignment, label); 249b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe return false; 250b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe } 251d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return true; 252d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe} 253d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 254d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Markobool DexFileVerifier::CheckSizeLimit(uint32_t size, uint32_t limit, const char* label) { 255d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko if (size > limit) { 256d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko ErrorStringPrintf("Size(%u) should not exceed limit(%u) for %s.", size, limit, label); 257d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko return false; 258d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko } 259d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko return true; 260d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko} 261d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko 2628d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckHeader() { 263f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao // Check file size from the header. 264f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao uint32_t expected_size = header_->file_size_; 265f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao if (size_ != expected_size) { 2668d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad file size (%zd, expected %ud)", size_, expected_size); 26710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 26810037c866b04550fc5461058c398c2e3e509381ajeffhao } 26910037c866b04550fc5461058c398c2e3e509381ajeffhao 27010037c866b04550fc5461058c398c2e3e509381ajeffhao // Compute and verify the checksum in the header. 27110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t adler_checksum = adler32(0L, Z_NULL, 0); 27210037c866b04550fc5461058c398c2e3e509381ajeffhao const uint32_t non_sum = sizeof(header_->magic_) + sizeof(header_->checksum_); 27313735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* non_sum_ptr = reinterpret_cast<const uint8_t*>(header_) + non_sum; 274f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao adler_checksum = adler32(adler_checksum, non_sum_ptr, expected_size - non_sum); 27510037c866b04550fc5461058c398c2e3e509381ajeffhao if (adler_checksum != header_->checksum_) { 2768d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad checksum (%08x, expected %08x)", adler_checksum, header_->checksum_); 27710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 27810037c866b04550fc5461058c398c2e3e509381ajeffhao } 27910037c866b04550fc5461058c398c2e3e509381ajeffhao 28010037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the contents of the header. 28110037c866b04550fc5461058c398c2e3e509381ajeffhao if (header_->endian_tag_ != DexFile::kDexEndianConstant) { 2828d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unexpected endian_tag: %x", header_->endian_tag_); 28310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 28410037c866b04550fc5461058c398c2e3e509381ajeffhao } 28510037c866b04550fc5461058c398c2e3e509381ajeffhao 28610037c866b04550fc5461058c398c2e3e509381ajeffhao if (header_->header_size_ != sizeof(DexFile::Header)) { 2878d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad header size: %ud", header_->header_size_); 28810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 28910037c866b04550fc5461058c398c2e3e509381ajeffhao } 29010037c866b04550fc5461058c398c2e3e509381ajeffhao 291d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe // Check that all offsets are inside the file. 292d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe bool result = 293b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe CheckValidOffsetAndSize(header_->link_off_, 294b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe header_->link_size_, 295b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe 0 /* unaligned */, 296b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe "link") && 297b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe CheckValidOffsetAndSize(header_->map_off_, 298b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe header_->map_off_, 299b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe 4, 300b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe "map") && 301b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe CheckValidOffsetAndSize(header_->string_ids_off_, 302b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe header_->string_ids_size_, 303b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe 4, 304b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe "string-ids") && 305b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe CheckValidOffsetAndSize(header_->type_ids_off_, 306b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe header_->type_ids_size_, 307b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe 4, 308b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe "type-ids") && 309d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko CheckSizeLimit(header_->type_ids_size_, DexFile::kDexNoIndex16, "type-ids") && 310b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe CheckValidOffsetAndSize(header_->proto_ids_off_, 311b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe header_->proto_ids_size_, 312b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe 4, 313b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe "proto-ids") && 314d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko CheckSizeLimit(header_->proto_ids_size_, DexFile::kDexNoIndex16, "proto-ids") && 315b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe CheckValidOffsetAndSize(header_->field_ids_off_, 316b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe header_->field_ids_size_, 317b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe 4, 318b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe "field-ids") && 319b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe CheckValidOffsetAndSize(header_->method_ids_off_, 320b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe header_->method_ids_size_, 321b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe 4, 322b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe "method-ids") && 323b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe CheckValidOffsetAndSize(header_->class_defs_off_, 324b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe header_->class_defs_size_, 325b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe 4, 326b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe "class-defs") && 327b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe CheckValidOffsetAndSize(header_->data_off_, 328b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe header_->data_size_, 329b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe 0, // Unaligned, spec doesn't talk about it, even though size 330b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe // is supposed to be a multiple of 4. 331b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe "data"); 332d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return result; 33310037c866b04550fc5461058c398c2e3e509381ajeffhao} 33410037c866b04550fc5461058c398c2e3e509381ajeffhao 3358d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckMap() { 336d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe const DexFile::MapList* map = reinterpret_cast<const DexFile::MapList*>(begin_ + 337d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe header_->map_off_); 338d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe // Check that map list content is available. 339d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckListSize(map, 1, sizeof(DexFile::MapList), "maplist content")) { 340d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return false; 341d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 342d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 34310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MapItem* item = map->list_; 34410037c866b04550fc5461058c398c2e3e509381ajeffhao 34510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = map->size_; 34610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_offset = 0; 34710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t data_item_count = 0; 34810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t data_items_left = header_->data_size_; 34910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t used_bits = 0; 35010037c866b04550fc5461058c398c2e3e509381ajeffhao 35110037c866b04550fc5461058c398c2e3e509381ajeffhao // Sanity check the size of the map list. 35210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(item, count, sizeof(DexFile::MapItem), "map size")) { 35310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 35410037c866b04550fc5461058c398c2e3e509381ajeffhao } 35510037c866b04550fc5461058c398c2e3e509381ajeffhao 35610037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the items listed in the map. 35710037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < count; i++) { 3588d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_offset >= item->offset_ && i != 0)) { 3598d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out of order map item: %x then %x", last_offset, item->offset_); 36010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 36110037c866b04550fc5461058c398c2e3e509381ajeffhao } 3628d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(item->offset_ >= header_->file_size_)) { 3638d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map item after end of file: %x, size %x", 3648d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers item->offset_, header_->file_size_); 36510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 36610037c866b04550fc5461058c398c2e3e509381ajeffhao } 36710037c866b04550fc5461058c398c2e3e509381ajeffhao 36810037c866b04550fc5461058c398c2e3e509381ajeffhao if (IsDataSectionType(item->type_)) { 36910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t icount = item->size_; 3708d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(icount > data_items_left)) { 3718d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Too many items in data section: %ud", data_item_count + icount); 37210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 37310037c866b04550fc5461058c398c2e3e509381ajeffhao } 37410037c866b04550fc5461058c398c2e3e509381ajeffhao data_items_left -= icount; 37510037c866b04550fc5461058c398c2e3e509381ajeffhao data_item_count += icount; 37610037c866b04550fc5461058c398c2e3e509381ajeffhao } 37710037c866b04550fc5461058c398c2e3e509381ajeffhao 37810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t bit = MapTypeToBitMask(item->type_); 37910037c866b04550fc5461058c398c2e3e509381ajeffhao 3808d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(bit == 0)) { 3818d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map section type %x", item->type_); 38210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 38310037c866b04550fc5461058c398c2e3e509381ajeffhao } 38410037c866b04550fc5461058c398c2e3e509381ajeffhao 3858d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & bit) != 0)) { 3868d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Duplicate map section of type %x", item->type_); 38710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 38810037c866b04550fc5461058c398c2e3e509381ajeffhao } 38910037c866b04550fc5461058c398c2e3e509381ajeffhao 39010037c866b04550fc5461058c398c2e3e509381ajeffhao used_bits |= bit; 39110037c866b04550fc5461058c398c2e3e509381ajeffhao last_offset = item->offset_; 39210037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 39310037c866b04550fc5461058c398c2e3e509381ajeffhao } 39410037c866b04550fc5461058c398c2e3e509381ajeffhao 39510037c866b04550fc5461058c398c2e3e509381ajeffhao // Check for missing sections in the map. 3968d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeHeaderItem)) == 0)) { 3978d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing header entry"); 39810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 39910037c866b04550fc5461058c398c2e3e509381ajeffhao } 4008d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeMapList)) == 0)) { 4018d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing map_list entry"); 40210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 40310037c866b04550fc5461058c398c2e3e509381ajeffhao } 4048d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeStringIdItem)) == 0 && 4058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->string_ids_off_ != 0) || (header_->string_ids_size_ != 0)))) { 4068d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing string_ids entry"); 40710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 40810037c866b04550fc5461058c398c2e3e509381ajeffhao } 4098d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeTypeIdItem)) == 0 && 4108d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->type_ids_off_ != 0) || (header_->type_ids_size_ != 0)))) { 4118d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing type_ids entry"); 41210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 41310037c866b04550fc5461058c398c2e3e509381ajeffhao } 4148d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeProtoIdItem)) == 0 && 4158d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->proto_ids_off_ != 0) || (header_->proto_ids_size_ != 0)))) { 4168d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing proto_ids entry"); 41710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 41810037c866b04550fc5461058c398c2e3e509381ajeffhao } 4198d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeFieldIdItem)) == 0 && 4208d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->field_ids_off_ != 0) || (header_->field_ids_size_ != 0)))) { 4218d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing field_ids entry"); 42210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 42310037c866b04550fc5461058c398c2e3e509381ajeffhao } 4248d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeMethodIdItem)) == 0 && 4258d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->method_ids_off_ != 0) || (header_->method_ids_size_ != 0)))) { 4268d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing method_ids entry"); 42710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 42810037c866b04550fc5461058c398c2e3e509381ajeffhao } 4298d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeClassDefItem)) == 0 && 4308d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->class_defs_off_ != 0) || (header_->class_defs_size_ != 0)))) { 4318d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing class_defs entry"); 43210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 43310037c866b04550fc5461058c398c2e3e509381ajeffhao } 43410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 43510037c866b04550fc5461058c398c2e3e509381ajeffhao} 43610037c866b04550fc5461058c398c2e3e509381ajeffhao 43710037c866b04550fc5461058c398c2e3e509381ajeffhaouint32_t DexFileVerifier::ReadUnsignedLittleEndian(uint32_t size) { 43810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t result = 0; 43913735955f39b3b304c37d2b2840663c131262c18Ian Rogers if (LIKELY(CheckListSize(ptr_, size, sizeof(uint8_t), "encoded_value"))) { 4408d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers for (uint32_t i = 0; i < size; i++) { 4418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers result |= ((uint32_t) *(ptr_++)) << (i * 8); 4428d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } 44310037c866b04550fc5461058c398c2e3e509381ajeffhao } 44410037c866b04550fc5461058c398c2e3e509381ajeffhao return result; 44510037c866b04550fc5461058c398c2e3e509381ajeffhao} 44610037c866b04550fc5461058c398c2e3e509381ajeffhao 44710037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckAndGetHandlerOffsets(const DexFile::CodeItem* code_item, 4488d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers uint32_t* handler_offsets, uint32_t handlers_size) { 44913735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* handlers_base = DexFile::GetCatchHandlerData(*code_item, 0); 45010037c866b04550fc5461058c398c2e3e509381ajeffhao 45110037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < handlers_size; i++) { 45210037c866b04550fc5461058c398c2e3e509381ajeffhao bool catch_all; 4538a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t offset = ptr_ - handlers_base; 45410037c866b04550fc5461058c398c2e3e509381ajeffhao int32_t size = DecodeSignedLeb128(&ptr_); 45510037c866b04550fc5461058c398c2e3e509381ajeffhao 4568d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((size < -65536) || (size > 65536))) { 4578d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid exception handler size: %d", size); 45810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 45910037c866b04550fc5461058c398c2e3e509381ajeffhao } 46010037c866b04550fc5461058c398c2e3e509381ajeffhao 46110037c866b04550fc5461058c398c2e3e509381ajeffhao if (size <= 0) { 46210037c866b04550fc5461058c398c2e3e509381ajeffhao catch_all = true; 46310037c866b04550fc5461058c398c2e3e509381ajeffhao size = -size; 46410037c866b04550fc5461058c398c2e3e509381ajeffhao } else { 46510037c866b04550fc5461058c398c2e3e509381ajeffhao catch_all = false; 46610037c866b04550fc5461058c398c2e3e509381ajeffhao } 46710037c866b04550fc5461058c398c2e3e509381ajeffhao 4688a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers handler_offsets[i] = static_cast<uint32_t>(offset); 46910037c866b04550fc5461058c398c2e3e509381ajeffhao 47010037c866b04550fc5461058c398c2e3e509381ajeffhao while (size-- > 0) { 47110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t type_idx = DecodeUnsignedLeb128(&ptr_); 47210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(type_idx, header_->type_ids_size_, "handler type_idx")) { 47310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 47410037c866b04550fc5461058c398c2e3e509381ajeffhao } 47510037c866b04550fc5461058c398c2e3e509381ajeffhao 47610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t addr = DecodeUnsignedLeb128(&ptr_); 4778d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(addr >= code_item->insns_size_in_code_units_)) { 4788d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid handler addr: %x", addr); 47910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 48010037c866b04550fc5461058c398c2e3e509381ajeffhao } 48110037c866b04550fc5461058c398c2e3e509381ajeffhao } 48210037c866b04550fc5461058c398c2e3e509381ajeffhao 48310037c866b04550fc5461058c398c2e3e509381ajeffhao if (catch_all) { 48410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t addr = DecodeUnsignedLeb128(&ptr_); 4858d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(addr >= code_item->insns_size_in_code_units_)) { 4868d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid handler catch_all_addr: %x", addr); 48710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 48810037c866b04550fc5461058c398c2e3e509381ajeffhao } 48910037c866b04550fc5461058c398c2e3e509381ajeffhao } 49010037c866b04550fc5461058c398c2e3e509381ajeffhao } 49110037c866b04550fc5461058c398c2e3e509381ajeffhao 49210037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 49310037c866b04550fc5461058c398c2e3e509381ajeffhao} 49410037c866b04550fc5461058c398c2e3e509381ajeffhao 495e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::CheckClassDataItemField(uint32_t idx, 496e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t access_flags, 497e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t class_access_flags, 4981a9735701d0826adbc9d68cd3762b78f96499cfbAndreas Gampe uint16_t class_type_index, 4998d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers bool expect_static) { 500e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check for overflow. 50110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->field_ids_size_, "class_data_item field_idx")) { 50210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 50310037c866b04550fc5461058c398c2e3e509381ajeffhao } 50410037c866b04550fc5461058c398c2e3e509381ajeffhao 505e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check that it's the right class. 506e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint16_t my_class_index = 507e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (reinterpret_cast<const DexFile::FieldId*>(begin_ + header_->field_ids_off_) + idx)-> 508e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_idx_; 509e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (class_type_index != my_class_index) { 510e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ErrorStringPrintf("Field's class index unexpected, %" PRIu16 "vs %" PRIu16, 511e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe my_class_index, 512e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_type_index); 513e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 514e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 515e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 516e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check that it falls into the right class-data list. 51710037c866b04550fc5461058c398c2e3e509381ajeffhao bool is_static = (access_flags & kAccStatic) != 0; 5188d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(is_static != expect_static)) { 5198d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Static/instance field not in expected list"); 52010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 52110037c866b04550fc5461058c398c2e3e509381ajeffhao } 52210037c866b04550fc5461058c398c2e3e509381ajeffhao 523e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check field access flags. 524e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::string error_msg; 525c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe if (!CheckFieldAccessFlags(idx, access_flags, class_access_flags, &error_msg)) { 526e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ErrorStringPrintf("%s", error_msg.c_str()); 52710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 52810037c866b04550fc5461058c398c2e3e509381ajeffhao } 52910037c866b04550fc5461058c398c2e3e509381ajeffhao 53010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 53110037c866b04550fc5461058c398c2e3e509381ajeffhao} 53210037c866b04550fc5461058c398c2e3e509381ajeffhao 533e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::CheckClassDataItemMethod(uint32_t idx, 534e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t access_flags, 535e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t class_access_flags, 5361a9735701d0826adbc9d68cd3762b78f96499cfbAndreas Gampe uint16_t class_type_index, 537a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao uint32_t code_offset, 538e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::unordered_set<uint32_t>* direct_method_indexes, 539a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao bool expect_direct) { 540e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe DCHECK(direct_method_indexes != nullptr); 541e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check for overflow. 54210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->method_ids_size_, "class_data_item method_idx")) { 54310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 54410037c866b04550fc5461058c398c2e3e509381ajeffhao } 54510037c866b04550fc5461058c398c2e3e509381ajeffhao 546e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check that it's the right class. 547e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint16_t my_class_index = 548e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (reinterpret_cast<const DexFile::MethodId*>(begin_ + header_->method_ids_off_) + idx)-> 549e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_idx_; 550e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (class_type_index != my_class_index) { 551e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ErrorStringPrintf("Method's class index unexpected, %" PRIu16 "vs %" PRIu16, 552e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe my_class_index, 553e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_type_index); 55410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 55510037c866b04550fc5461058c398c2e3e509381ajeffhao } 55610037c866b04550fc5461058c398c2e3e509381ajeffhao 557e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check that it's not defined as both direct and virtual. 558a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao if (expect_direct) { 559e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe direct_method_indexes->insert(idx); 560e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } else if (direct_method_indexes->find(idx) != direct_method_indexes->end()) { 561a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao ErrorStringPrintf("Found virtual method with same index as direct method: %d", idx); 562a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao return false; 563a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao } 564a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao 565e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check method access flags. 566e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool has_code = (code_offset != 0); 567e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::string error_msg; 568e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckMethodAccessFlags(idx, 569e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe access_flags, 570e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_access_flags, 571e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe has_code, 572e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe expect_direct, 573e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &error_msg)) { 574e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ErrorStringPrintf("%s", error_msg.c_str()); 57510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 57610037c866b04550fc5461058c398c2e3e509381ajeffhao } 57710037c866b04550fc5461058c398c2e3e509381ajeffhao 57810037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 57910037c866b04550fc5461058c398c2e3e509381ajeffhao} 58010037c866b04550fc5461058c398c2e3e509381ajeffhao 5818a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckPadding(size_t offset, uint32_t aligned_offset) { 58210037c866b04550fc5461058c398c2e3e509381ajeffhao if (offset < aligned_offset) { 58313735955f39b3b304c37d2b2840663c131262c18Ian Rogers if (!CheckListSize(begin_ + offset, aligned_offset - offset, sizeof(uint8_t), "section")) { 58410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 58510037c866b04550fc5461058c398c2e3e509381ajeffhao } 58610037c866b04550fc5461058c398c2e3e509381ajeffhao while (offset < aligned_offset) { 5878d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(*ptr_ != '\0')) { 5888a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Non-zero padding %x before section start at %zx", *ptr_, offset); 58910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 59010037c866b04550fc5461058c398c2e3e509381ajeffhao } 59110037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_++; 59210037c866b04550fc5461058c398c2e3e509381ajeffhao offset++; 59310037c866b04550fc5461058c398c2e3e509381ajeffhao } 59410037c866b04550fc5461058c398c2e3e509381ajeffhao } 59510037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 59610037c866b04550fc5461058c398c2e3e509381ajeffhao} 59710037c866b04550fc5461058c398c2e3e509381ajeffhao 59810037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckEncodedValue() { 59913735955f39b3b304c37d2b2840663c131262c18Ian Rogers if (!CheckListSize(ptr_, 1, sizeof(uint8_t), "encoded_value header")) { 60010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 60110037c866b04550fc5461058c398c2e3e509381ajeffhao } 60210037c866b04550fc5461058c398c2e3e509381ajeffhao 60310037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t header_byte = *(ptr_++); 60410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t value_type = header_byte & DexFile::kDexAnnotationValueTypeMask; 60510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t value_arg = header_byte >> DexFile::kDexAnnotationValueArgShift; 60610037c866b04550fc5461058c398c2e3e509381ajeffhao 60710037c866b04550fc5461058c398c2e3e509381ajeffhao switch (value_type) { 60810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationByte: 6098d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 6108d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value byte size %x", value_arg); 61110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 61210037c866b04550fc5461058c398c2e3e509381ajeffhao } 61310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_++; 61410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 61510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationShort: 61610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationChar: 6178d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 1)) { 6188d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value char/short size %x", value_arg); 61910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 62010037c866b04550fc5461058c398c2e3e509381ajeffhao } 62110037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += value_arg + 1; 62210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 62310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationInt: 62410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationFloat: 6258d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 6268d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value int/float size %x", value_arg); 62710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 62810037c866b04550fc5461058c398c2e3e509381ajeffhao } 62910037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += value_arg + 1; 63010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 63110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationLong: 63210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationDouble: 63310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += value_arg + 1; 63410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 63510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationString: { 6368d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 6378d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value string size %x", value_arg); 63810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 63910037c866b04550fc5461058c398c2e3e509381ajeffhao } 64010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 64110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->string_ids_size_, "encoded_value string")) { 64210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 64310037c866b04550fc5461058c398c2e3e509381ajeffhao } 64410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 64510037c866b04550fc5461058c398c2e3e509381ajeffhao } 64610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationType: { 6478d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 6488d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value type size %x", value_arg); 64910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 65010037c866b04550fc5461058c398c2e3e509381ajeffhao } 65110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 65210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->type_ids_size_, "encoded_value type")) { 65310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 65410037c866b04550fc5461058c398c2e3e509381ajeffhao } 65510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 65610037c866b04550fc5461058c398c2e3e509381ajeffhao } 65710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationField: 65810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationEnum: { 6598d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 6608d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value field/enum size %x", value_arg); 66110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 66210037c866b04550fc5461058c398c2e3e509381ajeffhao } 66310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 66410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->field_ids_size_, "encoded_value field")) { 66510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 66610037c866b04550fc5461058c398c2e3e509381ajeffhao } 66710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 66810037c866b04550fc5461058c398c2e3e509381ajeffhao } 66910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationMethod: { 6708d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 6718d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value method size %x", value_arg); 67210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 67310037c866b04550fc5461058c398c2e3e509381ajeffhao } 67410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 67510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->method_ids_size_, "encoded_value method")) { 67610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 67710037c866b04550fc5461058c398c2e3e509381ajeffhao } 67810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 67910037c866b04550fc5461058c398c2e3e509381ajeffhao } 68010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationArray: 6818d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 6828d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value array value_arg %x", value_arg); 68310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 68410037c866b04550fc5461058c398c2e3e509381ajeffhao } 68510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedArray()) { 68610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 68710037c866b04550fc5461058c398c2e3e509381ajeffhao } 68810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 68910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationAnnotation: 6908d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 6918d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value annotation value_arg %x", value_arg); 69210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 69310037c866b04550fc5461058c398c2e3e509381ajeffhao } 69410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedAnnotation()) { 69510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 69610037c866b04550fc5461058c398c2e3e509381ajeffhao } 69710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 69810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationNull: 6998d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 7008d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value null value_arg %x", value_arg); 70110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 70210037c866b04550fc5461058c398c2e3e509381ajeffhao } 70310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 70410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationBoolean: 7058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 1)) { 7068d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value boolean size %x", value_arg); 70710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 70810037c866b04550fc5461058c398c2e3e509381ajeffhao } 70910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 71010037c866b04550fc5461058c398c2e3e509381ajeffhao default: 7118d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bogus encoded_value value_type %x", value_type); 71210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 71310037c866b04550fc5461058c398c2e3e509381ajeffhao } 71410037c866b04550fc5461058c398c2e3e509381ajeffhao 71510037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 71610037c866b04550fc5461058c398c2e3e509381ajeffhao} 71710037c866b04550fc5461058c398c2e3e509381ajeffhao 71810037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckEncodedArray() { 71910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = DecodeUnsignedLeb128(&ptr_); 72010037c866b04550fc5461058c398c2e3e509381ajeffhao 72110037c866b04550fc5461058c398c2e3e509381ajeffhao while (size--) { 72210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedValue()) { 7238d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers failure_reason_ = StringPrintf("Bad encoded_array value: %s", failure_reason_.c_str()); 72410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 72510037c866b04550fc5461058c398c2e3e509381ajeffhao } 72610037c866b04550fc5461058c398c2e3e509381ajeffhao } 72710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 72810037c866b04550fc5461058c398c2e3e509381ajeffhao} 72910037c866b04550fc5461058c398c2e3e509381ajeffhao 73010037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckEncodedAnnotation() { 73110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = DecodeUnsignedLeb128(&ptr_); 73210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->type_ids_size_, "encoded_annotation type_idx")) { 73310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 73410037c866b04550fc5461058c398c2e3e509381ajeffhao } 73510037c866b04550fc5461058c398c2e3e509381ajeffhao 73610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = DecodeUnsignedLeb128(&ptr_); 73710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_idx = 0; 73810037c866b04550fc5461058c398c2e3e509381ajeffhao 73910037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < size; i++) { 74010037c866b04550fc5461058c398c2e3e509381ajeffhao idx = DecodeUnsignedLeb128(&ptr_); 74110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->string_ids_size_, "annotation_element name_idx")) { 74210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 74310037c866b04550fc5461058c398c2e3e509381ajeffhao } 74410037c866b04550fc5461058c398c2e3e509381ajeffhao 7458d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= idx && i != 0)) { 7468d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order annotation_element name_idx: %x then %x", 7478d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers last_idx, idx); 74810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 74910037c866b04550fc5461058c398c2e3e509381ajeffhao } 75010037c866b04550fc5461058c398c2e3e509381ajeffhao 75110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedValue()) { 75210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 75310037c866b04550fc5461058c398c2e3e509381ajeffhao } 75410037c866b04550fc5461058c398c2e3e509381ajeffhao 75510037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = idx; 75610037c866b04550fc5461058c398c2e3e509381ajeffhao } 75710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 75810037c866b04550fc5461058c398c2e3e509381ajeffhao} 75910037c866b04550fc5461058c398c2e3e509381ajeffhao 760e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::FindClassFlags(uint32_t index, 761e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool is_field, 762e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint16_t* class_type_index, 763e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t* class_access_flags) { 764e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe DCHECK(class_type_index != nullptr); 765e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe DCHECK(class_access_flags != nullptr); 76610037c866b04550fc5461058c398c2e3e509381ajeffhao 767e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // First check if the index is valid. 768e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (index >= (is_field ? header_->field_ids_size_ : header_->method_ids_size_)) { 769e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 77010037c866b04550fc5461058c398c2e3e509381ajeffhao } 771e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 772e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Next get the type index. 773e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (is_field) { 774e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *class_type_index = 775e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (reinterpret_cast<const DexFile::FieldId*>(begin_ + header_->field_ids_off_) + index)-> 776e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_idx_; 777e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } else { 778e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *class_type_index = 779e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (reinterpret_cast<const DexFile::MethodId*>(begin_ + header_->method_ids_off_) + index)-> 780e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_idx_; 781e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 782e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 783e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check if that is valid. 784e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (*class_type_index >= header_->type_ids_size_) { 785e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 786e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 787e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 788e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Now search for the class def. This is basically a specialized version of the DexFile code, as 789e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // we should not trust that this is a valid DexFile just yet. 790e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const DexFile::ClassDef* class_def_begin = 791e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe reinterpret_cast<const DexFile::ClassDef*>(begin_ + header_->class_defs_off_); 792e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe for (size_t i = 0; i < header_->class_defs_size_; ++i) { 793e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const DexFile::ClassDef* class_def = class_def_begin + i; 794e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (class_def->class_idx_ == *class_type_index) { 795e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *class_access_flags = class_def->access_flags_; 796e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 797ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao } 798e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 799e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 800e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Didn't find the class-def, not defined here... 801e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 802e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 803e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 804e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::CheckOrderAndGetClassFlags(bool is_field, 805e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const char* type_descr, 806e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t curr_index, 807e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t prev_index, 808e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool* have_class, 809e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint16_t* class_type_index, 810e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t* class_access_flags) { 811e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (curr_index < prev_index) { 812e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ErrorStringPrintf("out-of-order %s indexes %" PRIu32 " and %" PRIu32, 813e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe type_descr, 814e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe prev_index, 815e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe curr_index); 816e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 817e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 818e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 819e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!*have_class) { 820e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *have_class = FindClassFlags(curr_index, is_field, class_type_index, class_access_flags); 821e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!*have_class) { 822e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Should have really found one. 823e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ErrorStringPrintf("could not find declaring class for %s index %" PRIu32, 824e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe type_descr, 825e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe curr_index); 82610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 82710037c866b04550fc5461058c398c2e3e509381ajeffhao } 82810037c866b04550fc5461058c398c2e3e509381ajeffhao } 829e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 830e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 831e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 832e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampetemplate <bool kStatic> 833e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::CheckIntraClassDataItemFields(ClassDataItemIterator* it, 834e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool* have_class, 835e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint16_t* class_type_index, 836e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t* class_access_flags) { 837e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe DCHECK(it != nullptr); 838e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // These calls use the raw access flags to check whether the whole dex field is valid. 839e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t prev_index = 0; 840e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe for (; kStatic ? it->HasNextStaticField() : it->HasNextInstanceField(); it->Next()) { 841e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t curr_index = it->GetMemberIndex(); 842e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckOrderAndGetClassFlags(true, 843e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kStatic ? "static field" : "instance field", 844e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe curr_index, 845e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe prev_index, 846e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe have_class, 847e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_type_index, 848e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_access_flags)) { 849ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao return false; 850ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao } 851ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao prev_index = curr_index; 852e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 853e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckClassDataItemField(curr_index, 854e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe it->GetRawMemberAccessFlags(), 855e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *class_access_flags, 856e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *class_type_index, 857e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kStatic)) { 85810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 85910037c866b04550fc5461058c398c2e3e509381ajeffhao } 86010037c866b04550fc5461058c398c2e3e509381ajeffhao } 861e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 862e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 863e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 864e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 865e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampetemplate <bool kDirect> 866e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::CheckIntraClassDataItemMethods( 867e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ClassDataItemIterator* it, 868e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::unordered_set<uint32_t>* direct_method_indexes, 869e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool* have_class, 870e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint16_t* class_type_index, 871e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t* class_access_flags) { 872e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t prev_index = 0; 873e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe for (; kDirect ? it->HasNextDirectMethod() : it->HasNextVirtualMethod(); it->Next()) { 874e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t curr_index = it->GetMemberIndex(); 875e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckOrderAndGetClassFlags(false, 876e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kDirect ? "direct method" : "virtual method", 877e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe curr_index, 878e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe prev_index, 879e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe have_class, 880e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_type_index, 881e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_access_flags)) { 882ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao return false; 883ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao } 884ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao prev_index = curr_index; 885e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 886e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckClassDataItemMethod(curr_index, 887e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe it->GetRawMemberAccessFlags(), 888e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *class_access_flags, 889e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *class_type_index, 890e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe it->GetMethodCodeItemOffset(), 891e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe direct_method_indexes, 892e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kDirect)) { 89310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 89410037c866b04550fc5461058c398c2e3e509381ajeffhao } 89510037c866b04550fc5461058c398c2e3e509381ajeffhao } 89610037c866b04550fc5461058c398c2e3e509381ajeffhao 897e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 898e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 899e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 900e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::CheckIntraClassDataItem() { 901e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ClassDataItemIterator it(*dex_file_, ptr_); 902e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::unordered_set<uint32_t> direct_method_indexes; 903e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 904e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // This code is complicated by the fact that we don't directly know which class this belongs to. 905e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // So we need to explicitly search with the first item we find (either field or method), and then, 906e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // as the lookup is expensive, cache the result. 907e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool have_class = false; 908e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint16_t class_type_index; 909e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t class_access_flags; 910e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 911e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check fields. 912e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckIntraClassDataItemFields<true>(&it, 913e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &have_class, 914e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_type_index, 915e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_access_flags)) { 916e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 917e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 918e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckIntraClassDataItemFields<false>(&it, 919e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &have_class, 920e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_type_index, 921e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_access_flags)) { 922e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 923e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 924e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 925e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check methods. 926e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckIntraClassDataItemMethods<true>(&it, 927e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &direct_method_indexes, 928e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &have_class, 929e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_type_index, 930e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_access_flags)) { 931e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 932e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 933e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckIntraClassDataItemMethods<false>(&it, 934e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &direct_method_indexes, 935e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &have_class, 936e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_type_index, 937e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_access_flags)) { 938e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 939e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 940e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 94110037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = it.EndDataPointer(); 94210037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 94310037c866b04550fc5461058c398c2e3e509381ajeffhao} 94410037c866b04550fc5461058c398c2e3e509381ajeffhao 94510037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraCodeItem() { 94610037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::CodeItem* code_item = reinterpret_cast<const DexFile::CodeItem*>(ptr_); 94750d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(code_item, 1, sizeof(DexFile::CodeItem), "code")) { 94810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 94910037c866b04550fc5461058c398c2e3e509381ajeffhao } 95010037c866b04550fc5461058c398c2e3e509381ajeffhao 9518d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(code_item->ins_size_ > code_item->registers_size_)) { 9528d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("ins_size (%ud) > registers_size (%ud)", 9538d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers code_item->ins_size_, code_item->registers_size_); 95410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 95510037c866b04550fc5461058c398c2e3e509381ajeffhao } 95610037c866b04550fc5461058c398c2e3e509381ajeffhao 9578d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((code_item->outs_size_ > 5) && 9588d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers (code_item->outs_size_ > code_item->registers_size_))) { 95910037c866b04550fc5461058c398c2e3e509381ajeffhao /* 96010037c866b04550fc5461058c398c2e3e509381ajeffhao * outs_size can be up to 5, even if registers_size is smaller, since the 96110037c866b04550fc5461058c398c2e3e509381ajeffhao * short forms of method invocation allow repetitions of a register multiple 96210037c866b04550fc5461058c398c2e3e509381ajeffhao * times within a single parameter list. However, longer parameter lists 96310037c866b04550fc5461058c398c2e3e509381ajeffhao * need to be represented in-order in the register file. 96410037c866b04550fc5461058c398c2e3e509381ajeffhao */ 9658d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("outs_size (%ud) > registers_size (%ud)", 9668d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers code_item->outs_size_, code_item->registers_size_); 96710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 96810037c866b04550fc5461058c398c2e3e509381ajeffhao } 96910037c866b04550fc5461058c398c2e3e509381ajeffhao 97010037c866b04550fc5461058c398c2e3e509381ajeffhao const uint16_t* insns = code_item->insns_; 97110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t insns_size = code_item->insns_size_in_code_units_; 97210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(insns, insns_size, sizeof(uint16_t), "insns size")) { 97310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 97410037c866b04550fc5461058c398c2e3e509381ajeffhao } 97510037c866b04550fc5461058c398c2e3e509381ajeffhao 97610037c866b04550fc5461058c398c2e3e509381ajeffhao // Grab the end of the insns if there are no try_items. 97710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t try_items_size = code_item->tries_size_; 97810037c866b04550fc5461058c398c2e3e509381ajeffhao if (try_items_size == 0) { 97913735955f39b3b304c37d2b2840663c131262c18Ian Rogers ptr_ = reinterpret_cast<const uint8_t*>(&insns[insns_size]); 98010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 98110037c866b04550fc5461058c398c2e3e509381ajeffhao } 98210037c866b04550fc5461058c398c2e3e509381ajeffhao 98310037c866b04550fc5461058c398c2e3e509381ajeffhao // try_items are 4-byte aligned. Verify the spacer is 0. 9848a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers if (((reinterpret_cast<uintptr_t>(&insns[insns_size]) & 3) != 0) && (insns[insns_size] != 0)) { 9858d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Non-zero padding: %x", insns[insns_size]); 98610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 98710037c866b04550fc5461058c398c2e3e509381ajeffhao } 98810037c866b04550fc5461058c398c2e3e509381ajeffhao 98910037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TryItem* try_items = DexFile::GetTryItems(*code_item, 0); 99010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(try_items, try_items_size, sizeof(DexFile::TryItem), "try_items size")) { 99110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 99210037c866b04550fc5461058c398c2e3e509381ajeffhao } 99310037c866b04550fc5461058c398c2e3e509381ajeffhao 9946a8df53d90e47e3256faf7ff0caed0acf377b99bAnestis Bechtsoudis ptr_ = DexFile::GetCatchHandlerData(*code_item, 0); 9956a8df53d90e47e3256faf7ff0caed0acf377b99bAnestis Bechtsoudis uint32_t handlers_size = DecodeUnsignedLeb128(&ptr_); 9966a8df53d90e47e3256faf7ff0caed0acf377b99bAnestis Bechtsoudis 9978d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((handlers_size == 0) || (handlers_size >= 65536))) { 9988d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid handlers_size: %ud", handlers_size); 99910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 100010037c866b04550fc5461058c398c2e3e509381ajeffhao } 100110037c866b04550fc5461058c398c2e3e509381ajeffhao 1002700a402244a1a423da4f3ba8032459f4b65fa18fIan Rogers std::unique_ptr<uint32_t[]> handler_offsets(new uint32_t[handlers_size]); 1003ee0fa76b2e5d39ad36d1ff144b2d0270df81e606Elliott Hughes if (!CheckAndGetHandlerOffsets(code_item, &handler_offsets[0], handlers_size)) { 100410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 100510037c866b04550fc5461058c398c2e3e509381ajeffhao } 100610037c866b04550fc5461058c398c2e3e509381ajeffhao 100710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_addr = 0; 100810037c866b04550fc5461058c398c2e3e509381ajeffhao while (try_items_size--) { 10098d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(try_items->start_addr_ < last_addr)) { 10108d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of_order try_item with start_addr: %x", try_items->start_addr_); 101110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 101210037c866b04550fc5461058c398c2e3e509381ajeffhao } 101310037c866b04550fc5461058c398c2e3e509381ajeffhao 10148d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(try_items->start_addr_ >= insns_size)) { 10158d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid try_item start_addr: %x", try_items->start_addr_); 101610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 101710037c866b04550fc5461058c398c2e3e509381ajeffhao } 101810037c866b04550fc5461058c398c2e3e509381ajeffhao 101910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t i; 102010037c866b04550fc5461058c398c2e3e509381ajeffhao for (i = 0; i < handlers_size; i++) { 102110037c866b04550fc5461058c398c2e3e509381ajeffhao if (try_items->handler_off_ == handler_offsets[i]) { 102210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 102310037c866b04550fc5461058c398c2e3e509381ajeffhao } 102410037c866b04550fc5461058c398c2e3e509381ajeffhao } 102510037c866b04550fc5461058c398c2e3e509381ajeffhao 10268d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(i == handlers_size)) { 10278d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bogus handler offset: %x", try_items->handler_off_); 102810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 102910037c866b04550fc5461058c398c2e3e509381ajeffhao } 103010037c866b04550fc5461058c398c2e3e509381ajeffhao 103110037c866b04550fc5461058c398c2e3e509381ajeffhao last_addr = try_items->start_addr_ + try_items->insn_count_; 10328d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_addr > insns_size)) { 10338d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid try_item insn_count: %x", try_items->insn_count_); 103410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 103510037c866b04550fc5461058c398c2e3e509381ajeffhao } 103610037c866b04550fc5461058c398c2e3e509381ajeffhao 103710037c866b04550fc5461058c398c2e3e509381ajeffhao try_items++; 103810037c866b04550fc5461058c398c2e3e509381ajeffhao } 103910037c866b04550fc5461058c398c2e3e509381ajeffhao 104010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 104110037c866b04550fc5461058c398c2e3e509381ajeffhao} 104210037c866b04550fc5461058c398c2e3e509381ajeffhao 104310037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraStringDataItem() { 104410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = DecodeUnsignedLeb128(&ptr_); 104513735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* file_end = begin_ + size_; 104610037c866b04550fc5461058c398c2e3e509381ajeffhao 104710037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < size; i++) { 1048c647564845429bd709ed3338c13f15063c2f9fd9Brian Carlstrom CHECK_LT(i, size); // b/15014252 Prevents hitting the impossible case below 10498d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(ptr_ >= file_end)) { 10508d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("String data would go beyond end-of-file"); 105110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 105210037c866b04550fc5461058c398c2e3e509381ajeffhao } 105310037c866b04550fc5461058c398c2e3e509381ajeffhao 105410037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte = *(ptr_++); 105510037c866b04550fc5461058c398c2e3e509381ajeffhao 105610037c866b04550fc5461058c398c2e3e509381ajeffhao // Switch on the high 4 bits. 105710037c866b04550fc5461058c398c2e3e509381ajeffhao switch (byte >> 4) { 105810037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x00: 105910037c866b04550fc5461058c398c2e3e509381ajeffhao // Special case of bit pattern 0xxx. 10608d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(byte == 0)) { 1061c647564845429bd709ed3338c13f15063c2f9fd9Brian Carlstrom CHECK_LT(i, size); // b/15014252 Actually hit this impossible case with clang 10628d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("String data shorter than indicated utf16_size %x", size); 106310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 106410037c866b04550fc5461058c398c2e3e509381ajeffhao } 106510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 106610037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x01: 106710037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x02: 106810037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x03: 106910037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x04: 107010037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x05: 107110037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x06: 107210037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x07: 107310037c866b04550fc5461058c398c2e3e509381ajeffhao // No extra checks necessary for bit pattern 0xxx. 107410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 107510037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x08: 107610037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x09: 107710037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0a: 107810037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0b: 107910037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0f: 108010037c866b04550fc5461058c398c2e3e509381ajeffhao // Illegal bit patterns 10xx or 1111. 108110037c866b04550fc5461058c398c2e3e509381ajeffhao // Note: 1111 is valid for normal UTF-8, but not here. 10828d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal start byte %x in string data", byte); 108310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 108410037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0c: 108510037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0d: { 108610037c866b04550fc5461058c398c2e3e509381ajeffhao // Bit pattern 110x has an additional byte. 108710037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte2 = *(ptr_++); 10888d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((byte2 & 0xc0) != 0x80)) { 10898d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal continuation byte %x in string data", byte2); 109010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 109110037c866b04550fc5461058c398c2e3e509381ajeffhao } 109210037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t value = ((byte & 0x1f) << 6) | (byte2 & 0x3f); 10938d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((value != 0) && (value < 0x80))) { 10948d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal representation for value %x in string data", value); 109510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 109610037c866b04550fc5461058c398c2e3e509381ajeffhao } 109710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 109810037c866b04550fc5461058c398c2e3e509381ajeffhao } 109910037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0e: { 110010037c866b04550fc5461058c398c2e3e509381ajeffhao // Bit pattern 1110 has 2 additional bytes. 110110037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte2 = *(ptr_++); 11028d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((byte2 & 0xc0) != 0x80)) { 11038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal continuation byte %x in string data", byte2); 110410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 110510037c866b04550fc5461058c398c2e3e509381ajeffhao } 110610037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte3 = *(ptr_++); 11078d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((byte3 & 0xc0) != 0x80)) { 11088d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal continuation byte %x in string data", byte3); 110910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 111010037c866b04550fc5461058c398c2e3e509381ajeffhao } 111110037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t value = ((byte & 0x0f) << 12) | ((byte2 & 0x3f) << 6) | (byte3 & 0x3f); 11128d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value < 0x800)) { 11138d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal representation for value %x in string data", value); 111410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 111510037c866b04550fc5461058c398c2e3e509381ajeffhao } 111610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 111710037c866b04550fc5461058c398c2e3e509381ajeffhao } 111810037c866b04550fc5461058c398c2e3e509381ajeffhao } 111910037c866b04550fc5461058c398c2e3e509381ajeffhao } 112010037c866b04550fc5461058c398c2e3e509381ajeffhao 11218d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(*(ptr_++) != '\0')) { 11228d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("String longer than indicated size %x", size); 112310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 112410037c866b04550fc5461058c398c2e3e509381ajeffhao } 112510037c866b04550fc5461058c398c2e3e509381ajeffhao 112610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 112710037c866b04550fc5461058c398c2e3e509381ajeffhao} 112810037c866b04550fc5461058c398c2e3e509381ajeffhao 112910037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraDebugInfoItem() { 113010037c866b04550fc5461058c398c2e3e509381ajeffhao DecodeUnsignedLeb128(&ptr_); 113110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameters_size = DecodeUnsignedLeb128(&ptr_); 11328d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(parameters_size > 65536)) { 11338d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid parameters_size: %x", parameters_size); 113410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 113510037c866b04550fc5461058c398c2e3e509381ajeffhao } 113610037c866b04550fc5461058c398c2e3e509381ajeffhao 113710037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t j = 0; j < parameters_size; j++) { 113810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameter_name = DecodeUnsignedLeb128(&ptr_); 113910037c866b04550fc5461058c398c2e3e509381ajeffhao if (parameter_name != 0) { 114010037c866b04550fc5461058c398c2e3e509381ajeffhao parameter_name--; 114110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(parameter_name, header_->string_ids_size_, "debug_info_item parameter_name")) { 114210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 114310037c866b04550fc5461058c398c2e3e509381ajeffhao } 114410037c866b04550fc5461058c398c2e3e509381ajeffhao } 114510037c866b04550fc5461058c398c2e3e509381ajeffhao } 114610037c866b04550fc5461058c398c2e3e509381ajeffhao 114710037c866b04550fc5461058c398c2e3e509381ajeffhao while (true) { 114810037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t opcode = *(ptr_++); 114910037c866b04550fc5461058c398c2e3e509381ajeffhao switch (opcode) { 115010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_END_SEQUENCE: { 115110037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 115210037c866b04550fc5461058c398c2e3e509381ajeffhao } 115310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_ADVANCE_PC: { 115410037c866b04550fc5461058c398c2e3e509381ajeffhao DecodeUnsignedLeb128(&ptr_); 115510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 115610037c866b04550fc5461058c398c2e3e509381ajeffhao } 115710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_ADVANCE_LINE: { 115810037c866b04550fc5461058c398c2e3e509381ajeffhao DecodeSignedLeb128(&ptr_); 115910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 116010037c866b04550fc5461058c398c2e3e509381ajeffhao } 116110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_START_LOCAL: { 116210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t reg_num = DecodeUnsignedLeb128(&ptr_); 11638d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(reg_num >= 65536)) { 11648d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad reg_num for opcode %x", opcode); 116510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 116610037c866b04550fc5461058c398c2e3e509381ajeffhao } 116710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t name_idx = DecodeUnsignedLeb128(&ptr_); 116810037c866b04550fc5461058c398c2e3e509381ajeffhao if (name_idx != 0) { 116910037c866b04550fc5461058c398c2e3e509381ajeffhao name_idx--; 117010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(name_idx, header_->string_ids_size_, "DBG_START_LOCAL name_idx")) { 117110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 117210037c866b04550fc5461058c398c2e3e509381ajeffhao } 117310037c866b04550fc5461058c398c2e3e509381ajeffhao } 117410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t type_idx = DecodeUnsignedLeb128(&ptr_); 117510037c866b04550fc5461058c398c2e3e509381ajeffhao if (type_idx != 0) { 117610037c866b04550fc5461058c398c2e3e509381ajeffhao type_idx--; 1177dd3208d3b2f4b78678a341f38a5cc7761c7fca91Logan Chien if (!CheckIndex(type_idx, header_->type_ids_size_, "DBG_START_LOCAL type_idx")) { 117810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 117910037c866b04550fc5461058c398c2e3e509381ajeffhao } 118010037c866b04550fc5461058c398c2e3e509381ajeffhao } 118110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 118210037c866b04550fc5461058c398c2e3e509381ajeffhao } 118310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_END_LOCAL: 118410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_RESTART_LOCAL: { 118510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t reg_num = DecodeUnsignedLeb128(&ptr_); 11868d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(reg_num >= 65536)) { 11878d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad reg_num for opcode %x", opcode); 118810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 118910037c866b04550fc5461058c398c2e3e509381ajeffhao } 119010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 119110037c866b04550fc5461058c398c2e3e509381ajeffhao } 119210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_START_LOCAL_EXTENDED: { 119310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t reg_num = DecodeUnsignedLeb128(&ptr_); 11948d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(reg_num >= 65536)) { 11958d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad reg_num for opcode %x", opcode); 119610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 119710037c866b04550fc5461058c398c2e3e509381ajeffhao } 119810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t name_idx = DecodeUnsignedLeb128(&ptr_); 119910037c866b04550fc5461058c398c2e3e509381ajeffhao if (name_idx != 0) { 120010037c866b04550fc5461058c398c2e3e509381ajeffhao name_idx--; 120110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(name_idx, header_->string_ids_size_, "DBG_START_LOCAL_EXTENDED name_idx")) { 120210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 120310037c866b04550fc5461058c398c2e3e509381ajeffhao } 120410037c866b04550fc5461058c398c2e3e509381ajeffhao } 120510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t type_idx = DecodeUnsignedLeb128(&ptr_); 120610037c866b04550fc5461058c398c2e3e509381ajeffhao if (type_idx != 0) { 120710037c866b04550fc5461058c398c2e3e509381ajeffhao type_idx--; 1208dd3208d3b2f4b78678a341f38a5cc7761c7fca91Logan Chien if (!CheckIndex(type_idx, header_->type_ids_size_, "DBG_START_LOCAL_EXTENDED type_idx")) { 120910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 121010037c866b04550fc5461058c398c2e3e509381ajeffhao } 121110037c866b04550fc5461058c398c2e3e509381ajeffhao } 121210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t sig_idx = DecodeUnsignedLeb128(&ptr_); 121310037c866b04550fc5461058c398c2e3e509381ajeffhao if (sig_idx != 0) { 121410037c866b04550fc5461058c398c2e3e509381ajeffhao sig_idx--; 121510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(sig_idx, header_->string_ids_size_, "DBG_START_LOCAL_EXTENDED sig_idx")) { 121610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 121710037c866b04550fc5461058c398c2e3e509381ajeffhao } 121810037c866b04550fc5461058c398c2e3e509381ajeffhao } 121910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 122010037c866b04550fc5461058c398c2e3e509381ajeffhao } 122110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_SET_FILE: { 122210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t name_idx = DecodeUnsignedLeb128(&ptr_); 122310037c866b04550fc5461058c398c2e3e509381ajeffhao if (name_idx != 0) { 122410037c866b04550fc5461058c398c2e3e509381ajeffhao name_idx--; 122510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(name_idx, header_->string_ids_size_, "DBG_SET_FILE name_idx")) { 122610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 122710037c866b04550fc5461058c398c2e3e509381ajeffhao } 122810037c866b04550fc5461058c398c2e3e509381ajeffhao } 122910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 123010037c866b04550fc5461058c398c2e3e509381ajeffhao } 123110037c866b04550fc5461058c398c2e3e509381ajeffhao } 123210037c866b04550fc5461058c398c2e3e509381ajeffhao } 123310037c866b04550fc5461058c398c2e3e509381ajeffhao} 123410037c866b04550fc5461058c398c2e3e509381ajeffhao 123510037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraAnnotationItem() { 123613735955f39b3b304c37d2b2840663c131262c18Ian Rogers if (!CheckListSize(ptr_, 1, sizeof(uint8_t), "annotation visibility")) { 123710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 123810037c866b04550fc5461058c398c2e3e509381ajeffhao } 123910037c866b04550fc5461058c398c2e3e509381ajeffhao 124010037c866b04550fc5461058c398c2e3e509381ajeffhao // Check visibility 124110037c866b04550fc5461058c398c2e3e509381ajeffhao switch (*(ptr_++)) { 124210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexVisibilityBuild: 124310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexVisibilityRuntime: 124410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexVisibilitySystem: 124510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 124610037c866b04550fc5461058c398c2e3e509381ajeffhao default: 12478d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad annotation visibility: %x", *ptr_); 124810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 124910037c866b04550fc5461058c398c2e3e509381ajeffhao } 125010037c866b04550fc5461058c398c2e3e509381ajeffhao 125110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedAnnotation()) { 125210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 125310037c866b04550fc5461058c398c2e3e509381ajeffhao } 125410037c866b04550fc5461058c398c2e3e509381ajeffhao 125510037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 125610037c866b04550fc5461058c398c2e3e509381ajeffhao} 125710037c866b04550fc5461058c398c2e3e509381ajeffhao 125810037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraAnnotationsDirectoryItem() { 125910037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationsDirectoryItem* item = 126010037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationsDirectoryItem*>(ptr_); 126150d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(item, 1, sizeof(DexFile::AnnotationsDirectoryItem), "annotations_directory")) { 126210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 126310037c866b04550fc5461058c398c2e3e509381ajeffhao } 126410037c866b04550fc5461058c398c2e3e509381ajeffhao 126510037c866b04550fc5461058c398c2e3e509381ajeffhao // Field annotations follow immediately after the annotations directory. 126610037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldAnnotationsItem* field_item = 126710037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::FieldAnnotationsItem*>(item + 1); 126810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t field_count = item->fields_size_; 126910037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(field_item, field_count, sizeof(DexFile::FieldAnnotationsItem), "field_annotations list")) { 127010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 127110037c866b04550fc5461058c398c2e3e509381ajeffhao } 127210037c866b04550fc5461058c398c2e3e509381ajeffhao 127310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_idx = 0; 127410037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < field_count; i++) { 12758d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= field_item->field_idx_ && i != 0)) { 12768d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_idx for annotation: %x then %x", last_idx, field_item->field_idx_); 127710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 127810037c866b04550fc5461058c398c2e3e509381ajeffhao } 127910037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = field_item->field_idx_; 128010037c866b04550fc5461058c398c2e3e509381ajeffhao field_item++; 128110037c866b04550fc5461058c398c2e3e509381ajeffhao } 128210037c866b04550fc5461058c398c2e3e509381ajeffhao 128310037c866b04550fc5461058c398c2e3e509381ajeffhao // Method annotations follow immediately after field annotations. 128410037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodAnnotationsItem* method_item = 128510037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::MethodAnnotationsItem*>(field_item); 128610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t method_count = item->methods_size_; 128710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(method_item, method_count, sizeof(DexFile::MethodAnnotationsItem), "method_annotations list")) { 128810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 128910037c866b04550fc5461058c398c2e3e509381ajeffhao } 129010037c866b04550fc5461058c398c2e3e509381ajeffhao 129110037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = 0; 129210037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < method_count; i++) { 12938d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= method_item->method_idx_ && i != 0)) { 12948d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_idx for annotation: %x then %x", 12958d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers last_idx, method_item->method_idx_); 129610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 129710037c866b04550fc5461058c398c2e3e509381ajeffhao } 129810037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = method_item->method_idx_; 129910037c866b04550fc5461058c398c2e3e509381ajeffhao method_item++; 130010037c866b04550fc5461058c398c2e3e509381ajeffhao } 130110037c866b04550fc5461058c398c2e3e509381ajeffhao 130210037c866b04550fc5461058c398c2e3e509381ajeffhao // Parameter annotations follow immediately after method annotations. 130310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ParameterAnnotationsItem* parameter_item = 130410037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::ParameterAnnotationsItem*>(method_item); 130510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameter_count = item->parameters_size_; 13062b87ddf36abff711fa2233c49bffc7ceb03b15d7Dragos Sbirlea if (!CheckListSize(parameter_item, parameter_count, sizeof(DexFile::ParameterAnnotationsItem), 13078d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers "parameter_annotations list")) { 130810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 130910037c866b04550fc5461058c398c2e3e509381ajeffhao } 131010037c866b04550fc5461058c398c2e3e509381ajeffhao 131110037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = 0; 131210037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < parameter_count; i++) { 13138d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= parameter_item->method_idx_ && i != 0)) { 13148d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_idx for annotation: %x then %x", 13158d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers last_idx, parameter_item->method_idx_); 131610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 131710037c866b04550fc5461058c398c2e3e509381ajeffhao } 131810037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = parameter_item->method_idx_; 131910037c866b04550fc5461058c398c2e3e509381ajeffhao parameter_item++; 132010037c866b04550fc5461058c398c2e3e509381ajeffhao } 132110037c866b04550fc5461058c398c2e3e509381ajeffhao 132210037c866b04550fc5461058c398c2e3e509381ajeffhao // Return a pointer to the end of the annotations. 132313735955f39b3b304c37d2b2840663c131262c18Ian Rogers ptr_ = reinterpret_cast<const uint8_t*>(parameter_item); 132410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 132510037c866b04550fc5461058c398c2e3e509381ajeffhao} 132610037c866b04550fc5461058c398c2e3e509381ajeffhao 1327b061cc1dc41a976f5a620c19498d4b2f4d1675dbAndreas Gampebool DexFileVerifier::CheckIntraSectionIterate(size_t offset, uint32_t section_count, 1328b061cc1dc41a976f5a620c19498d4b2f4d1675dbAndreas Gampe uint16_t type) { 132910037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the right alignment mask for the type of section. 13308a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t alignment_mask; 133110037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 133210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 133310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: 133410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: 133510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: 133610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: 133710037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint8_t) - 1; 133810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 133910037c866b04550fc5461058c398c2e3e509381ajeffhao default: 134010037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint32_t) - 1; 134110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 134210037c866b04550fc5461058c398c2e3e509381ajeffhao } 134310037c866b04550fc5461058c398c2e3e509381ajeffhao 134410037c866b04550fc5461058c398c2e3e509381ajeffhao // Iterate through the items in the section. 1345b061cc1dc41a976f5a620c19498d4b2f4d1675dbAndreas Gampe for (uint32_t i = 0; i < section_count; i++) { 13468a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t aligned_offset = (offset + alignment_mask) & ~alignment_mask; 134710037c866b04550fc5461058c398c2e3e509381ajeffhao 134810037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the padding between items. 134910037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPadding(offset, aligned_offset)) { 135010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 135110037c866b04550fc5461058c398c2e3e509381ajeffhao } 135210037c866b04550fc5461058c398c2e3e509381ajeffhao 135310037c866b04550fc5461058c398c2e3e509381ajeffhao // Check depending on the section type. 135410037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 135510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: { 135650d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::StringId), "string_ids")) { 135710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 135810037c866b04550fc5461058c398c2e3e509381ajeffhao } 135910037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::StringId); 136010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 136110037c866b04550fc5461058c398c2e3e509381ajeffhao } 136210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: { 136350d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::TypeId), "type_ids")) { 136410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 136510037c866b04550fc5461058c398c2e3e509381ajeffhao } 136610037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::TypeId); 136710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 136810037c866b04550fc5461058c398c2e3e509381ajeffhao } 136910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: { 137050d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::ProtoId), "proto_ids")) { 137110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 137210037c866b04550fc5461058c398c2e3e509381ajeffhao } 137310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ProtoId); 137410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 137510037c866b04550fc5461058c398c2e3e509381ajeffhao } 137610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: { 137750d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::FieldId), "field_ids")) { 137810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 137910037c866b04550fc5461058c398c2e3e509381ajeffhao } 138010037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::FieldId); 138110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 138210037c866b04550fc5461058c398c2e3e509381ajeffhao } 138310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: { 138450d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::MethodId), "method_ids")) { 138510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 138610037c866b04550fc5461058c398c2e3e509381ajeffhao } 138710037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::MethodId); 138810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 138910037c866b04550fc5461058c398c2e3e509381ajeffhao } 139010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: { 139150d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::ClassDef), "class_defs")) { 139210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 139310037c866b04550fc5461058c398c2e3e509381ajeffhao } 139410037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ClassDef); 139510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 139610037c866b04550fc5461058c398c2e3e509381ajeffhao } 139710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: { 1398d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckList(sizeof(DexFile::TypeItem), "type_list", &ptr_)) { 139910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 140010037c866b04550fc5461058c398c2e3e509381ajeffhao } 140110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 140210037c866b04550fc5461058c398c2e3e509381ajeffhao } 140310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: { 1404d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckList(sizeof(DexFile::AnnotationSetRefItem), "annotation_set_ref_list", &ptr_)) { 140510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 140610037c866b04550fc5461058c398c2e3e509381ajeffhao } 140710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 140810037c866b04550fc5461058c398c2e3e509381ajeffhao } 140910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: { 1410d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckList(sizeof(uint32_t), "annotation_set_item", &ptr_)) { 141110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 141210037c866b04550fc5461058c398c2e3e509381ajeffhao } 141310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 141410037c866b04550fc5461058c398c2e3e509381ajeffhao } 141510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: { 141610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraClassDataItem()) { 141710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 141810037c866b04550fc5461058c398c2e3e509381ajeffhao } 141910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 142010037c866b04550fc5461058c398c2e3e509381ajeffhao } 142110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: { 142210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraCodeItem()) { 142310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 142410037c866b04550fc5461058c398c2e3e509381ajeffhao } 142510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 142610037c866b04550fc5461058c398c2e3e509381ajeffhao } 142710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: { 142810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraStringDataItem()) { 142910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 143010037c866b04550fc5461058c398c2e3e509381ajeffhao } 143110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 143210037c866b04550fc5461058c398c2e3e509381ajeffhao } 143310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: { 143410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraDebugInfoItem()) { 143510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 143610037c866b04550fc5461058c398c2e3e509381ajeffhao } 143710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 143810037c866b04550fc5461058c398c2e3e509381ajeffhao } 143910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: { 144010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraAnnotationItem()) { 144110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 144210037c866b04550fc5461058c398c2e3e509381ajeffhao } 144310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 144410037c866b04550fc5461058c398c2e3e509381ajeffhao } 144510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: { 144610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedArray()) { 144710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 144810037c866b04550fc5461058c398c2e3e509381ajeffhao } 144910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 145010037c866b04550fc5461058c398c2e3e509381ajeffhao } 145110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: { 145210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraAnnotationsDirectoryItem()) { 145310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 145410037c866b04550fc5461058c398c2e3e509381ajeffhao } 145510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 145610037c866b04550fc5461058c398c2e3e509381ajeffhao } 145710037c866b04550fc5461058c398c2e3e509381ajeffhao default: 14588d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 145910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 146010037c866b04550fc5461058c398c2e3e509381ajeffhao } 146110037c866b04550fc5461058c398c2e3e509381ajeffhao 146210037c866b04550fc5461058c398c2e3e509381ajeffhao if (IsDataSectionType(type)) { 14630f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier if (aligned_offset == 0u) { 14640f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier ErrorStringPrintf("Item %d offset is 0", i); 14650f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier return false; 14660f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier } 14670f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier DCHECK(offset_to_type_map_.Find(aligned_offset) == offset_to_type_map_.end()); 14680f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier offset_to_type_map_.Insert(std::pair<uint32_t, uint16_t>(aligned_offset, type)); 146910037c866b04550fc5461058c398c2e3e509381ajeffhao } 147010037c866b04550fc5461058c398c2e3e509381ajeffhao 14718a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers aligned_offset = ptr_ - begin_; 14728d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(aligned_offset > size_)) { 14738d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Item %d at ends out of bounds", i); 147410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 147510037c866b04550fc5461058c398c2e3e509381ajeffhao } 147610037c866b04550fc5461058c398c2e3e509381ajeffhao 147710037c866b04550fc5461058c398c2e3e509381ajeffhao offset = aligned_offset; 147810037c866b04550fc5461058c398c2e3e509381ajeffhao } 147910037c866b04550fc5461058c398c2e3e509381ajeffhao 148010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 148110037c866b04550fc5461058c398c2e3e509381ajeffhao} 148210037c866b04550fc5461058c398c2e3e509381ajeffhao 14838a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckIntraIdSection(size_t offset, uint32_t count, uint16_t type) { 148410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t expected_offset; 148510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t expected_size; 148610037c866b04550fc5461058c398c2e3e509381ajeffhao 148710037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the expected offset and size from the header. 148810037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 148910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 149010037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->string_ids_off_; 149110037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->string_ids_size_; 149210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 149310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 149410037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->type_ids_off_; 149510037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->type_ids_size_; 149610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 149710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 149810037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->proto_ids_off_; 149910037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->proto_ids_size_; 150010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 150110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 150210037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->field_ids_off_; 150310037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->field_ids_size_; 150410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 150510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 150610037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->method_ids_off_; 150710037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->method_ids_size_; 150810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 150910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 151010037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->class_defs_off_; 151110037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->class_defs_size_; 151210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 151310037c866b04550fc5461058c398c2e3e509381ajeffhao default: 15148d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad type for id section: %x", type); 151510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 151610037c866b04550fc5461058c398c2e3e509381ajeffhao } 151710037c866b04550fc5461058c398c2e3e509381ajeffhao 151810037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the offset and size are what were expected from the header. 15198d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(offset != expected_offset)) { 15208a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Bad offset for section: got %zx, expected %x", offset, expected_offset); 152110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 152210037c866b04550fc5461058c398c2e3e509381ajeffhao } 15238d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(count != expected_size)) { 15248d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad size for section: got %x, expected %x", count, expected_size); 152510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 152610037c866b04550fc5461058c398c2e3e509381ajeffhao } 152710037c866b04550fc5461058c398c2e3e509381ajeffhao 152810037c866b04550fc5461058c398c2e3e509381ajeffhao return CheckIntraSectionIterate(offset, count, type); 152910037c866b04550fc5461058c398c2e3e509381ajeffhao} 153010037c866b04550fc5461058c398c2e3e509381ajeffhao 15318a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckIntraDataSection(size_t offset, uint32_t count, uint16_t type) { 15328a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t data_start = header_->data_off_; 15338a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t data_end = data_start + header_->data_size_; 153410037c866b04550fc5461058c398c2e3e509381ajeffhao 153510037c866b04550fc5461058c398c2e3e509381ajeffhao // Sanity check the offset of the section. 15368d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((offset < data_start) || (offset > data_end))) { 15378a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Bad offset for data subsection: %zx", offset); 153810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 153910037c866b04550fc5461058c398c2e3e509381ajeffhao } 154010037c866b04550fc5461058c398c2e3e509381ajeffhao 154110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraSectionIterate(offset, count, type)) { 154210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 154310037c866b04550fc5461058c398c2e3e509381ajeffhao } 154410037c866b04550fc5461058c398c2e3e509381ajeffhao 15458a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t next_offset = ptr_ - begin_; 154610037c866b04550fc5461058c398c2e3e509381ajeffhao if (next_offset > data_end) { 15478a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Out-of-bounds end of data subsection: %zx", next_offset); 154810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 154910037c866b04550fc5461058c398c2e3e509381ajeffhao } 155010037c866b04550fc5461058c398c2e3e509381ajeffhao 155110037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 155210037c866b04550fc5461058c398c2e3e509381ajeffhao} 155310037c866b04550fc5461058c398c2e3e509381ajeffhao 155410037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraSection() { 155530fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers const DexFile::MapList* map = reinterpret_cast<const DexFile::MapList*>(begin_ + header_->map_off_); 155610037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MapItem* item = map->list_; 155710037c866b04550fc5461058c398c2e3e509381ajeffhao 155810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = map->size_; 15598a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t offset = 0; 156030fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers ptr_ = begin_; 156110037c866b04550fc5461058c398c2e3e509381ajeffhao 156210037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the items listed in the map. 156310037c866b04550fc5461058c398c2e3e509381ajeffhao while (count--) { 156410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_offset = item->offset_; 156510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_count = item->size_; 156610037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t type = item->type_; 156710037c866b04550fc5461058c398c2e3e509381ajeffhao 156810037c866b04550fc5461058c398c2e3e509381ajeffhao // Check for padding and overlap between items. 156910037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPadding(offset, section_offset)) { 157010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 15718d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } else if (UNLIKELY(offset > section_offset)) { 15728a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Section overlap or out-of-order map: %zx, %x", offset, section_offset); 157310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 157410037c866b04550fc5461058c398c2e3e509381ajeffhao } 157510037c866b04550fc5461058c398c2e3e509381ajeffhao 157610037c866b04550fc5461058c398c2e3e509381ajeffhao // Check each item based on its type. 157710037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 157810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: 15798d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_count != 1)) { 15808d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Multiple header items"); 158110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 158210037c866b04550fc5461058c398c2e3e509381ajeffhao } 15838d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_offset != 0)) { 15848d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Header at %x, not at start of file", section_offset); 158510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 158610037c866b04550fc5461058c398c2e3e509381ajeffhao } 158730fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers ptr_ = begin_ + header_->header_size_; 158810037c866b04550fc5461058c398c2e3e509381ajeffhao offset = header_->header_size_; 158910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 159010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 159110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 159210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 159310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 159410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 159510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 159610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraIdSection(section_offset, section_count, type)) { 159710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 159810037c866b04550fc5461058c398c2e3e509381ajeffhao } 15998a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers offset = ptr_ - begin_; 160010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 160110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMapList: 16028d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_count != 1)) { 16038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Multiple map list items"); 160410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 160510037c866b04550fc5461058c398c2e3e509381ajeffhao } 16068d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_offset != header_->map_off_)) { 16078d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map not at header-defined offset: %x, expected %x", 16088d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers section_offset, header_->map_off_); 160910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 161010037c866b04550fc5461058c398c2e3e509381ajeffhao } 161110037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(uint32_t) + (map->size_ * sizeof(DexFile::MapItem)); 161210037c866b04550fc5461058c398c2e3e509381ajeffhao offset = section_offset + sizeof(uint32_t) + (map->size_ * sizeof(DexFile::MapItem)); 161310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 161410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: 161510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: 161610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: 161710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 161810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: 161910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: 162010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: 162110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: 162210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: 162310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: 162410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraDataSection(section_offset, section_count, type)) { 162510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 162610037c866b04550fc5461058c398c2e3e509381ajeffhao } 16278a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers offset = ptr_ - begin_; 162810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 162910037c866b04550fc5461058c398c2e3e509381ajeffhao default: 16308d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 163110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 163210037c866b04550fc5461058c398c2e3e509381ajeffhao } 163310037c866b04550fc5461058c398c2e3e509381ajeffhao 163410037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 163510037c866b04550fc5461058c398c2e3e509381ajeffhao } 163610037c866b04550fc5461058c398c2e3e509381ajeffhao 163710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 163810037c866b04550fc5461058c398c2e3e509381ajeffhao} 163910037c866b04550fc5461058c398c2e3e509381ajeffhao 16408a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckOffsetToTypeMap(size_t offset, uint16_t type) { 16410f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier DCHECK_NE(offset, 0u); 16420f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier auto it = offset_to_type_map_.Find(offset); 16438d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(it == offset_to_type_map_.end())) { 16448a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("No data map entry found @ %zx; expected %x", offset, type); 164510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 164610037c866b04550fc5461058c398c2e3e509381ajeffhao } 16478d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(it->second != type)) { 16488a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Unexpected data map entry @ %zx; expected %x, found %x", 16498d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers offset, type, it->second); 165010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 165110037c866b04550fc5461058c398c2e3e509381ajeffhao } 165210037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 165310037c866b04550fc5461058c398c2e3e509381ajeffhao} 165410037c866b04550fc5461058c398c2e3e509381ajeffhao 165513735955f39b3b304c37d2b2840663c131262c18Ian Rogersuint16_t DexFileVerifier::FindFirstClassDataDefiner(const uint8_t* ptr, bool* success) { 165610037c866b04550fc5461058c398c2e3e509381ajeffhao ClassDataItemIterator it(*dex_file_, ptr); 16575e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = true; 165810037c866b04550fc5461058c398c2e3e509381ajeffhao 165910037c866b04550fc5461058c398c2e3e509381ajeffhao if (it.HasNextStaticField() || it.HasNextInstanceField()) { 16605e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_FIELD(field, it.GetMemberIndex(), "first_class_data_definer field_id", 16615e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = false; return DexFile::kDexNoIndex16) 1662e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return field->class_idx_; 166310037c866b04550fc5461058c398c2e3e509381ajeffhao } 166410037c866b04550fc5461058c398c2e3e509381ajeffhao 166510037c866b04550fc5461058c398c2e3e509381ajeffhao if (it.HasNextDirectMethod() || it.HasNextVirtualMethod()) { 16665e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_METHOD(method, it.GetMemberIndex(), "first_class_data_definer method_id", 16675e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = false; return DexFile::kDexNoIndex16) 1668e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return method->class_idx_; 166910037c866b04550fc5461058c398c2e3e509381ajeffhao } 167010037c866b04550fc5461058c398c2e3e509381ajeffhao 167110037c866b04550fc5461058c398c2e3e509381ajeffhao return DexFile::kDexNoIndex16; 167210037c866b04550fc5461058c398c2e3e509381ajeffhao} 167310037c866b04550fc5461058c398c2e3e509381ajeffhao 167413735955f39b3b304c37d2b2840663c131262c18Ian Rogersuint16_t DexFileVerifier::FindFirstAnnotationsDirectoryDefiner(const uint8_t* ptr, bool* success) { 167510037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationsDirectoryItem* item = 167610037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationsDirectoryItem*>(ptr); 16775e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = true; 16785e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe 167910037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->fields_size_ != 0) { 168010037c866b04550fc5461058c398c2e3e509381ajeffhao DexFile::FieldAnnotationsItem* field_items = (DexFile::FieldAnnotationsItem*) (item + 1); 16815e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_FIELD(field, field_items[0].field_idx_, "first_annotations_dir_definer field_id", 16825e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = false; return DexFile::kDexNoIndex16) 1683e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return field->class_idx_; 168410037c866b04550fc5461058c398c2e3e509381ajeffhao } 168510037c866b04550fc5461058c398c2e3e509381ajeffhao 168610037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->methods_size_ != 0) { 168710037c866b04550fc5461058c398c2e3e509381ajeffhao DexFile::MethodAnnotationsItem* method_items = (DexFile::MethodAnnotationsItem*) (item + 1); 1688e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_METHOD(method, method_items[0].method_idx_, "first_annotations_dir_definer method id", 16895e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = false; return DexFile::kDexNoIndex16) 1690e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return method->class_idx_; 169110037c866b04550fc5461058c398c2e3e509381ajeffhao } 169210037c866b04550fc5461058c398c2e3e509381ajeffhao 169310037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->parameters_size_ != 0) { 169410037c866b04550fc5461058c398c2e3e509381ajeffhao DexFile::ParameterAnnotationsItem* parameter_items = (DexFile::ParameterAnnotationsItem*) (item + 1); 1695e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_METHOD(method, parameter_items[0].method_idx_, "first_annotations_dir_definer method id", 16965e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = false; return DexFile::kDexNoIndex16) 1697e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return method->class_idx_; 169810037c866b04550fc5461058c398c2e3e509381ajeffhao } 169910037c866b04550fc5461058c398c2e3e509381ajeffhao 170010037c866b04550fc5461058c398c2e3e509381ajeffhao return DexFile::kDexNoIndex16; 170110037c866b04550fc5461058c398c2e3e509381ajeffhao} 170210037c866b04550fc5461058c398c2e3e509381ajeffhao 170310037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterStringIdItem() { 170410037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::StringId* item = reinterpret_cast<const DexFile::StringId*>(ptr_); 170510037c866b04550fc5461058c398c2e3e509381ajeffhao 170610037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the map to make sure it has the right offset->type. 170710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckOffsetToTypeMap(item->string_data_off_, DexFile::kDexTypeStringDataItem)) { 170810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 170910037c866b04550fc5461058c398c2e3e509381ajeffhao } 171010037c866b04550fc5461058c398c2e3e509381ajeffhao 171110037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. 17122cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (previous_item_ != nullptr) { 171310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::StringId* prev_item = reinterpret_cast<const DexFile::StringId*>(previous_item_); 171410037c866b04550fc5461058c398c2e3e509381ajeffhao const char* prev_str = dex_file_->GetStringData(*prev_item); 171510037c866b04550fc5461058c398c2e3e509381ajeffhao const char* str = dex_file_->GetStringData(*item); 17168d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(CompareModifiedUtf8ToModifiedUtf8AsUtf16CodePointValues(prev_str, str) >= 0)) { 17178d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order string_ids: '%s' then '%s'", prev_str, str); 171810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 171910037c866b04550fc5461058c398c2e3e509381ajeffhao } 172010037c866b04550fc5461058c398c2e3e509381ajeffhao } 172110037c866b04550fc5461058c398c2e3e509381ajeffhao 172210037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::StringId); 172310037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 172410037c866b04550fc5461058c398c2e3e509381ajeffhao} 172510037c866b04550fc5461058c398c2e3e509381ajeffhao 172610037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterTypeIdItem() { 172710037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TypeId* item = reinterpret_cast<const DexFile::TypeId*>(ptr_); 1728e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 1729e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING(descriptor, item->descriptor_idx_, "inter_type_id_item descriptor_idx") 173010037c866b04550fc5461058c398c2e3e509381ajeffhao 173110037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the descriptor is a valid type. 17328d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidDescriptor(descriptor))) { 17338d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid type descriptor: '%s'", descriptor); 173410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 173510037c866b04550fc5461058c398c2e3e509381ajeffhao } 173610037c866b04550fc5461058c398c2e3e509381ajeffhao 173710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. 17382cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (previous_item_ != nullptr) { 173910037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TypeId* prev_item = reinterpret_cast<const DexFile::TypeId*>(previous_item_); 17408d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->descriptor_idx_ >= item->descriptor_idx_)) { 17418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order type_ids: %x then %x", 17428d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers prev_item->descriptor_idx_, item->descriptor_idx_); 174310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 174410037c866b04550fc5461058c398c2e3e509381ajeffhao } 174510037c866b04550fc5461058c398c2e3e509381ajeffhao } 174610037c866b04550fc5461058c398c2e3e509381ajeffhao 174710037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::TypeId); 174810037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 174910037c866b04550fc5461058c398c2e3e509381ajeffhao} 175010037c866b04550fc5461058c398c2e3e509381ajeffhao 175110037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterProtoIdItem() { 175210037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ProtoId* item = reinterpret_cast<const DexFile::ProtoId*>(ptr_); 1753e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 1754e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING(shorty, item->shorty_idx_, "inter_proto_id_item shorty_idx") 1755e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 175610037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->parameters_off_ != 0 && 175710037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->parameters_off_, DexFile::kDexTypeTypeList)) { 175810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 175910037c866b04550fc5461058c398c2e3e509381ajeffhao } 176010037c866b04550fc5461058c398c2e3e509381ajeffhao 176110037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the return type and advance the shorty. 1762e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(return_type, item->return_type_idx_, "inter_proto_id_item return_type_idx") 1763e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (!CheckShortyDescriptorMatch(*shorty, return_type, true)) { 176410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 176510037c866b04550fc5461058c398c2e3e509381ajeffhao } 176610037c866b04550fc5461058c398c2e3e509381ajeffhao shorty++; 176710037c866b04550fc5461058c398c2e3e509381ajeffhao 176810037c866b04550fc5461058c398c2e3e509381ajeffhao DexFileParameterIterator it(*dex_file_, *item); 176910037c866b04550fc5461058c398c2e3e509381ajeffhao while (it.HasNext() && *shorty != '\0') { 1770bb836e14541d5424328182f3e20ce08c691d041eAndreas Gampe if (!CheckIndex(it.GetTypeIdx(), dex_file_->NumTypeIds(), 1771bb836e14541d5424328182f3e20ce08c691d041eAndreas Gampe "inter_proto_id_item shorty type_idx")) { 1772bb836e14541d5424328182f3e20ce08c691d041eAndreas Gampe return false; 1773bb836e14541d5424328182f3e20ce08c691d041eAndreas Gampe } 177410037c866b04550fc5461058c398c2e3e509381ajeffhao const char* descriptor = it.GetDescriptor(); 177510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckShortyDescriptorMatch(*shorty, descriptor, false)) { 177610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 177710037c866b04550fc5461058c398c2e3e509381ajeffhao } 177810037c866b04550fc5461058c398c2e3e509381ajeffhao it.Next(); 177910037c866b04550fc5461058c398c2e3e509381ajeffhao shorty++; 178010037c866b04550fc5461058c398c2e3e509381ajeffhao } 17818d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(it.HasNext() || *shorty != '\0')) { 17828d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched length for parameters and shorty"); 178310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 178410037c866b04550fc5461058c398c2e3e509381ajeffhao } 178510037c866b04550fc5461058c398c2e3e509381ajeffhao 178610037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. This relies on type_ids being in order. 17872cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (previous_item_ != nullptr) { 178810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ProtoId* prev = reinterpret_cast<const DexFile::ProtoId*>(previous_item_); 17898d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev->return_type_idx_ > item->return_type_idx_)) { 17908d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order proto_id return types"); 179110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 179210037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev->return_type_idx_ == item->return_type_idx_) { 179310037c866b04550fc5461058c398c2e3e509381ajeffhao DexFileParameterIterator curr_it(*dex_file_, *item); 179410037c866b04550fc5461058c398c2e3e509381ajeffhao DexFileParameterIterator prev_it(*dex_file_, *prev); 179510037c866b04550fc5461058c398c2e3e509381ajeffhao 179610037c866b04550fc5461058c398c2e3e509381ajeffhao while (curr_it.HasNext() && prev_it.HasNext()) { 179710037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t prev_idx = prev_it.GetTypeIdx(); 179810037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t curr_idx = curr_it.GetTypeIdx(); 1799d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko DCHECK_NE(prev_idx, DexFile::kDexNoIndex16); 1800d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko DCHECK_NE(curr_idx, DexFile::kDexNoIndex16); 180110037c866b04550fc5461058c398c2e3e509381ajeffhao 180210037c866b04550fc5461058c398c2e3e509381ajeffhao if (prev_idx < curr_idx) { 180310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 18048d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } else if (UNLIKELY(prev_idx > curr_idx)) { 18058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order proto_id arguments"); 180610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 180710037c866b04550fc5461058c398c2e3e509381ajeffhao } 180810037c866b04550fc5461058c398c2e3e509381ajeffhao 180910037c866b04550fc5461058c398c2e3e509381ajeffhao prev_it.Next(); 181010037c866b04550fc5461058c398c2e3e509381ajeffhao curr_it.Next(); 181110037c866b04550fc5461058c398c2e3e509381ajeffhao } 1812d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko if (!curr_it.HasNext()) { 1813d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko // Either a duplicate ProtoId or a ProtoId with a shorter argument list follows 1814d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko // a ProtoId with a longer one. Both cases are forbidden by the specification. 1815d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko ErrorStringPrintf("Out-of-order proto_id arguments"); 1816d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko return false; 1817d6bcae6d82d99727150f0e3c3d9cb3e9bc739d50Vladimir Marko } 181810037c866b04550fc5461058c398c2e3e509381ajeffhao } 181910037c866b04550fc5461058c398c2e3e509381ajeffhao } 182010037c866b04550fc5461058c398c2e3e509381ajeffhao 182110037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ProtoId); 182210037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 182310037c866b04550fc5461058c398c2e3e509381ajeffhao} 182410037c866b04550fc5461058c398c2e3e509381ajeffhao 182510037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterFieldIdItem() { 182610037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldId* item = reinterpret_cast<const DexFile::FieldId*>(ptr_); 182710037c866b04550fc5461058c398c2e3e509381ajeffhao 182810037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the class descriptor is valid. 1829e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(class_descriptor, item->class_idx_, "inter_field_id_item class_idx") 1830e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(class_descriptor) || class_descriptor[0] != 'L')) { 1831e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid descriptor for class_idx: '%s'", class_descriptor); 183210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 183310037c866b04550fc5461058c398c2e3e509381ajeffhao } 183410037c866b04550fc5461058c398c2e3e509381ajeffhao 183510037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the type descriptor is a valid field name. 1836e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(type_descriptor, item->type_idx_, "inter_field_id_item type_idx") 1837e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(type_descriptor) || type_descriptor[0] == 'V')) { 1838e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid descriptor for type_idx: '%s'", type_descriptor); 183910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 184010037c866b04550fc5461058c398c2e3e509381ajeffhao } 184110037c866b04550fc5461058c398c2e3e509381ajeffhao 184210037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the name is valid. 1843e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING(descriptor, item->name_idx_, "inter_field_id_item name_idx") 18448d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidMemberName(descriptor))) { 18458d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid field name: '%s'", descriptor); 184610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 184710037c866b04550fc5461058c398c2e3e509381ajeffhao } 184810037c866b04550fc5461058c398c2e3e509381ajeffhao 184910037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. This relies on the other sections being in order. 18502cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (previous_item_ != nullptr) { 185110037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldId* prev_item = reinterpret_cast<const DexFile::FieldId*>(previous_item_); 18528d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->class_idx_ > item->class_idx_)) { 18538d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_ids"); 185410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 185510037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->class_idx_ == item->class_idx_) { 18568d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->name_idx_ > item->name_idx_)) { 18578d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_ids"); 185810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 185910037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->name_idx_ == item->name_idx_) { 18608d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->type_idx_ >= item->type_idx_)) { 18618d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_ids"); 186210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 186310037c866b04550fc5461058c398c2e3e509381ajeffhao } 186410037c866b04550fc5461058c398c2e3e509381ajeffhao } 186510037c866b04550fc5461058c398c2e3e509381ajeffhao } 186610037c866b04550fc5461058c398c2e3e509381ajeffhao } 186710037c866b04550fc5461058c398c2e3e509381ajeffhao 186810037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::FieldId); 186910037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 187010037c866b04550fc5461058c398c2e3e509381ajeffhao} 187110037c866b04550fc5461058c398c2e3e509381ajeffhao 187210037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterMethodIdItem() { 187310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodId* item = reinterpret_cast<const DexFile::MethodId*>(ptr_); 187410037c866b04550fc5461058c398c2e3e509381ajeffhao 187510037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the class descriptor is a valid reference name. 1876e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(class_descriptor, item->class_idx_, "inter_method_id_item class_idx") 1877e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(class_descriptor) || (class_descriptor[0] != 'L' && 1878e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe class_descriptor[0] != '['))) { 1879e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid descriptor for class_idx: '%s'", class_descriptor); 188010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 188110037c866b04550fc5461058c398c2e3e509381ajeffhao } 188210037c866b04550fc5461058c398c2e3e509381ajeffhao 188310037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the name is valid. 1884df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe LOAD_STRING(descriptor, item->name_idx_, "inter_method_id_item name_idx") 18858d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidMemberName(descriptor))) { 18868d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid method name: '%s'", descriptor); 188710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 188810037c866b04550fc5461058c398c2e3e509381ajeffhao } 188910037c866b04550fc5461058c398c2e3e509381ajeffhao 1890df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe // Check that the proto id is valid. 1891df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(!CheckIndex(item->proto_idx_, dex_file_->NumProtoIds(), 1892df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe "inter_method_id_item proto_idx"))) { 1893df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe return false; 1894df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe } 1895df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe 189610037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. This relies on the other sections being in order. 18972cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (previous_item_ != nullptr) { 189810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodId* prev_item = reinterpret_cast<const DexFile::MethodId*>(previous_item_); 18998d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->class_idx_ > item->class_idx_)) { 19008d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_ids"); 190110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 190210037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->class_idx_ == item->class_idx_) { 19038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->name_idx_ > item->name_idx_)) { 19048d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_ids"); 190510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 190610037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->name_idx_ == item->name_idx_) { 19078d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->proto_idx_ >= item->proto_idx_)) { 19088d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_ids"); 190910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 191010037c866b04550fc5461058c398c2e3e509381ajeffhao } 191110037c866b04550fc5461058c398c2e3e509381ajeffhao } 191210037c866b04550fc5461058c398c2e3e509381ajeffhao } 191310037c866b04550fc5461058c398c2e3e509381ajeffhao } 191410037c866b04550fc5461058c398c2e3e509381ajeffhao 191510037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::MethodId); 191610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 191710037c866b04550fc5461058c398c2e3e509381ajeffhao} 191810037c866b04550fc5461058c398c2e3e509381ajeffhao 191910037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterClassDefItem() { 192010037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ClassDef* item = reinterpret_cast<const DexFile::ClassDef*>(ptr_); 192110037c866b04550fc5461058c398c2e3e509381ajeffhao 19220ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe // Check for duplicate class def. 19230ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe if (defined_classes_.find(item->class_idx_) != defined_classes_.end()) { 19240ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe ErrorStringPrintf("Redefinition of class with type idx: '%d'", item->class_idx_); 19250ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe return false; 19260ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe } 19270ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe defined_classes_.insert(item->class_idx_); 19280ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe 1929e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(class_descriptor, item->class_idx_, "inter_class_def_item class_idx") 1930e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(class_descriptor) || class_descriptor[0] != 'L')) { 1931e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid class descriptor: '%s'", class_descriptor); 193210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 193310037c866b04550fc5461058c398c2e3e509381ajeffhao } 193410037c866b04550fc5461058c398c2e3e509381ajeffhao 1935acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe // Only allow non-runtime modifiers. 1936acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe if ((item->access_flags_ & ~kAccJavaFlagsMask) != 0) { 1937acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe ErrorStringPrintf("Invalid class flags: '%d'", item->access_flags_); 1938acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe return false; 1939acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe } 1940acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe 194110037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->interfaces_off_ != 0 && 194210037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->interfaces_off_, DexFile::kDexTypeTypeList)) { 194310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 194410037c866b04550fc5461058c398c2e3e509381ajeffhao } 194510037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->annotations_off_ != 0 && 194610037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->annotations_off_, DexFile::kDexTypeAnnotationsDirectoryItem)) { 194710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 194810037c866b04550fc5461058c398c2e3e509381ajeffhao } 194910037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->class_data_off_ != 0 && 195010037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->class_data_off_, DexFile::kDexTypeClassDataItem)) { 195110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 195210037c866b04550fc5461058c398c2e3e509381ajeffhao } 195310037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->static_values_off_ != 0 && 195410037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->static_values_off_, DexFile::kDexTypeEncodedArrayItem)) { 195510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 195610037c866b04550fc5461058c398c2e3e509381ajeffhao } 195710037c866b04550fc5461058c398c2e3e509381ajeffhao 195810037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->superclass_idx_ != DexFile::kDexNoIndex16) { 195931349988d7c44fe453bde9525fd10a371e543c28Roland Levillain if (header_->GetVersion() >= DexFile::kClassDefinitionOrderEnforcedVersion) { 196031349988d7c44fe453bde9525fd10a371e543c28Roland Levillain // Check that a class does not inherit from itself directly (by having 196131349988d7c44fe453bde9525fd10a371e543c28Roland Levillain // the same type idx as its super class). 196231349988d7c44fe453bde9525fd10a371e543c28Roland Levillain if (UNLIKELY(item->superclass_idx_ == item->class_idx_)) { 196331349988d7c44fe453bde9525fd10a371e543c28Roland Levillain ErrorStringPrintf("Class with same type idx as its superclass: '%d'", item->class_idx_); 196431349988d7c44fe453bde9525fd10a371e543c28Roland Levillain return false; 196531349988d7c44fe453bde9525fd10a371e543c28Roland Levillain } 196631349988d7c44fe453bde9525fd10a371e543c28Roland Levillain 196731349988d7c44fe453bde9525fd10a371e543c28Roland Levillain // Check that a class is defined after its super class (if the 196831349988d7c44fe453bde9525fd10a371e543c28Roland Levillain // latter is defined in the same Dex file). 196931349988d7c44fe453bde9525fd10a371e543c28Roland Levillain const DexFile::ClassDef* superclass_def = dex_file_->FindClassDef(item->superclass_idx_); 197031349988d7c44fe453bde9525fd10a371e543c28Roland Levillain if (superclass_def != nullptr) { 197131349988d7c44fe453bde9525fd10a371e543c28Roland Levillain // The superclass is defined in this Dex file. 197231349988d7c44fe453bde9525fd10a371e543c28Roland Levillain if (superclass_def > item) { 197331349988d7c44fe453bde9525fd10a371e543c28Roland Levillain // ClassDef item for super class appearing after the class' ClassDef item. 197431349988d7c44fe453bde9525fd10a371e543c28Roland Levillain ErrorStringPrintf("Invalid class definition ordering:" 197531349988d7c44fe453bde9525fd10a371e543c28Roland Levillain " class with type idx: '%d' defined before" 197631349988d7c44fe453bde9525fd10a371e543c28Roland Levillain " superclass with type idx: '%d'", 197731349988d7c44fe453bde9525fd10a371e543c28Roland Levillain item->class_idx_, 197831349988d7c44fe453bde9525fd10a371e543c28Roland Levillain item->superclass_idx_); 197931349988d7c44fe453bde9525fd10a371e543c28Roland Levillain return false; 198031349988d7c44fe453bde9525fd10a371e543c28Roland Levillain } 198131349988d7c44fe453bde9525fd10a371e543c28Roland Levillain } 198231349988d7c44fe453bde9525fd10a371e543c28Roland Levillain } 198331349988d7c44fe453bde9525fd10a371e543c28Roland Levillain 1984e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(superclass_descriptor, item->superclass_idx_, 1985e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe "inter_class_def_item superclass_idx") 1986e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(superclass_descriptor) || superclass_descriptor[0] != 'L')) { 1987e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid superclass: '%s'", superclass_descriptor); 198810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 198910037c866b04550fc5461058c398c2e3e509381ajeffhao } 199010037c866b04550fc5461058c398c2e3e509381ajeffhao } 199110037c866b04550fc5461058c398c2e3e509381ajeffhao 199231349988d7c44fe453bde9525fd10a371e543c28Roland Levillain // Check interfaces. 199310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TypeList* interfaces = dex_file_->GetInterfacesList(*item); 19942cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (interfaces != nullptr) { 199510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = interfaces->Size(); 199610037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < size; i++) { 199731349988d7c44fe453bde9525fd10a371e543c28Roland Levillain if (header_->GetVersion() >= DexFile::kClassDefinitionOrderEnforcedVersion) { 199831349988d7c44fe453bde9525fd10a371e543c28Roland Levillain // Check that a class does not implement itself directly (by having the 199931349988d7c44fe453bde9525fd10a371e543c28Roland Levillain // same type idx as one of its immediate implemented interfaces). 200031349988d7c44fe453bde9525fd10a371e543c28Roland Levillain if (UNLIKELY(interfaces->GetTypeItem(i).type_idx_ == item->class_idx_)) { 200131349988d7c44fe453bde9525fd10a371e543c28Roland Levillain ErrorStringPrintf("Class with same type idx as implemented interface: '%d'", 200231349988d7c44fe453bde9525fd10a371e543c28Roland Levillain item->class_idx_); 200331349988d7c44fe453bde9525fd10a371e543c28Roland Levillain return false; 200431349988d7c44fe453bde9525fd10a371e543c28Roland Levillain } 200531349988d7c44fe453bde9525fd10a371e543c28Roland Levillain 200631349988d7c44fe453bde9525fd10a371e543c28Roland Levillain // Check that a class is defined after the interfaces it implements 200731349988d7c44fe453bde9525fd10a371e543c28Roland Levillain // (if they are defined in the same Dex file). 200831349988d7c44fe453bde9525fd10a371e543c28Roland Levillain const DexFile::ClassDef* interface_def = 200931349988d7c44fe453bde9525fd10a371e543c28Roland Levillain dex_file_->FindClassDef(interfaces->GetTypeItem(i).type_idx_); 201031349988d7c44fe453bde9525fd10a371e543c28Roland Levillain if (interface_def != nullptr) { 201131349988d7c44fe453bde9525fd10a371e543c28Roland Levillain // The interface is defined in this Dex file. 201231349988d7c44fe453bde9525fd10a371e543c28Roland Levillain if (interface_def > item) { 201331349988d7c44fe453bde9525fd10a371e543c28Roland Levillain // ClassDef item for interface appearing after the class' ClassDef item. 201431349988d7c44fe453bde9525fd10a371e543c28Roland Levillain ErrorStringPrintf("Invalid class definition ordering:" 201531349988d7c44fe453bde9525fd10a371e543c28Roland Levillain " class with type idx: '%d' defined before" 201631349988d7c44fe453bde9525fd10a371e543c28Roland Levillain " implemented interface with type idx: '%d'", 201731349988d7c44fe453bde9525fd10a371e543c28Roland Levillain item->class_idx_, 201831349988d7c44fe453bde9525fd10a371e543c28Roland Levillain interfaces->GetTypeItem(i).type_idx_); 201931349988d7c44fe453bde9525fd10a371e543c28Roland Levillain return false; 202031349988d7c44fe453bde9525fd10a371e543c28Roland Levillain } 202131349988d7c44fe453bde9525fd10a371e543c28Roland Levillain } 202231349988d7c44fe453bde9525fd10a371e543c28Roland Levillain } 202331349988d7c44fe453bde9525fd10a371e543c28Roland Levillain 202431349988d7c44fe453bde9525fd10a371e543c28Roland Levillain // Ensure that the interface refers to a class (not an array nor a primitive type). 2025e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(inf_descriptor, interfaces->GetTypeItem(i).type_idx_, 2026e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe "inter_class_def_item interface type_idx") 2027e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(inf_descriptor) || inf_descriptor[0] != 'L')) { 2028e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid interface: '%s'", inf_descriptor); 202910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 203010037c866b04550fc5461058c398c2e3e509381ajeffhao } 203110037c866b04550fc5461058c398c2e3e509381ajeffhao } 203210037c866b04550fc5461058c398c2e3e509381ajeffhao 203310037c866b04550fc5461058c398c2e3e509381ajeffhao /* 203410037c866b04550fc5461058c398c2e3e509381ajeffhao * Ensure that there are no duplicates. This is an O(N^2) test, but in 203510037c866b04550fc5461058c398c2e3e509381ajeffhao * practice the number of interfaces implemented by any given class is low. 203610037c866b04550fc5461058c398c2e3e509381ajeffhao */ 203710037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 1; i < size; i++) { 203810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx1 = interfaces->GetTypeItem(i).type_idx_; 203910037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t j =0; j < i; j++) { 204010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx2 = interfaces->GetTypeItem(j).type_idx_; 20418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(idx1 == idx2)) { 20428d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Duplicate interface: '%s'", dex_file_->StringByTypeIdx(idx1)); 204310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 204410037c866b04550fc5461058c398c2e3e509381ajeffhao } 204510037c866b04550fc5461058c398c2e3e509381ajeffhao } 204610037c866b04550fc5461058c398c2e3e509381ajeffhao } 204710037c866b04550fc5461058c398c2e3e509381ajeffhao } 204810037c866b04550fc5461058c398c2e3e509381ajeffhao 204910037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that references in class_data_item are to the right class. 205010037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->class_data_off_ != 0) { 205113735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* data = begin_ + item->class_data_off_; 20525e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe bool success; 20535e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe uint16_t data_definer = FindFirstClassDataDefiner(data, &success); 20545e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe if (!success) { 2055e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; 2056e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 20578d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((data_definer != item->class_idx_) && (data_definer != DexFile::kDexNoIndex16))) { 20588d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid class_data_item"); 205910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 206010037c866b04550fc5461058c398c2e3e509381ajeffhao } 206110037c866b04550fc5461058c398c2e3e509381ajeffhao } 206210037c866b04550fc5461058c398c2e3e509381ajeffhao 206310037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that references in annotations_directory_item are to right class. 206410037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->annotations_off_ != 0) { 2065b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe // annotations_off_ is supposed to be aligned by 4. 2066b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe if (!IsAlignedParam(item->annotations_off_, 4)) { 2067b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe ErrorStringPrintf("Invalid annotations_off_, not aligned by 4"); 2068b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe return false; 2069b512c0e5da0767d00a0ee9b7201668ab9977e21bAndreas Gampe } 207013735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* data = begin_ + item->annotations_off_; 20715e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe bool success; 20725e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe uint16_t annotations_definer = FindFirstAnnotationsDirectoryDefiner(data, &success); 20735e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe if (!success) { 2074e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; 2075e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 20768d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((annotations_definer != item->class_idx_) && 20778d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers (annotations_definer != DexFile::kDexNoIndex16))) { 20788d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid annotations_directory_item"); 207910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 208010037c866b04550fc5461058c398c2e3e509381ajeffhao } 208110037c866b04550fc5461058c398c2e3e509381ajeffhao } 208210037c866b04550fc5461058c398c2e3e509381ajeffhao 208310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ClassDef); 208410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 208510037c866b04550fc5461058c398c2e3e509381ajeffhao} 208610037c866b04550fc5461058c398c2e3e509381ajeffhao 208710037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterAnnotationSetRefList() { 208810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationSetRefList* list = 208910037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationSetRefList*>(ptr_); 209010037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationSetRefItem* item = list->list_; 209110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = list->size_; 209210037c866b04550fc5461058c398c2e3e509381ajeffhao 209310037c866b04550fc5461058c398c2e3e509381ajeffhao while (count--) { 209410037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->annotations_off_ != 0 && 209510037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 209610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 209710037c866b04550fc5461058c398c2e3e509381ajeffhao } 209810037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 209910037c866b04550fc5461058c398c2e3e509381ajeffhao } 210010037c866b04550fc5461058c398c2e3e509381ajeffhao 210113735955f39b3b304c37d2b2840663c131262c18Ian Rogers ptr_ = reinterpret_cast<const uint8_t*>(item); 210210037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 210310037c866b04550fc5461058c398c2e3e509381ajeffhao} 210410037c866b04550fc5461058c398c2e3e509381ajeffhao 210510037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterAnnotationSetItem() { 210610037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationSetItem* set = reinterpret_cast<const DexFile::AnnotationSetItem*>(ptr_); 210710037c866b04550fc5461058c398c2e3e509381ajeffhao const uint32_t* offsets = set->entries_; 210810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = set->size_; 210910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_idx = 0; 211010037c866b04550fc5461058c398c2e3e509381ajeffhao 211110037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < count; i++) { 211210037c866b04550fc5461058c398c2e3e509381ajeffhao if (*offsets != 0 && !CheckOffsetToTypeMap(*offsets, DexFile::kDexTypeAnnotationItem)) { 211310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 211410037c866b04550fc5461058c398c2e3e509381ajeffhao } 211510037c866b04550fc5461058c398c2e3e509381ajeffhao 211610037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the annotation from the offset and the type index for the annotation. 211710037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationItem* annotation = 211830fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers reinterpret_cast<const DexFile::AnnotationItem*>(begin_ + *offsets); 211910037c866b04550fc5461058c398c2e3e509381ajeffhao const uint8_t* data = annotation->annotation_; 212010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = DecodeUnsignedLeb128(&data); 212110037c866b04550fc5461058c398c2e3e509381ajeffhao 21228d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= idx && i != 0)) { 21238d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order entry types: %x then %x", last_idx, idx); 212410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 212510037c866b04550fc5461058c398c2e3e509381ajeffhao } 212610037c866b04550fc5461058c398c2e3e509381ajeffhao 212710037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = idx; 212810037c866b04550fc5461058c398c2e3e509381ajeffhao offsets++; 212910037c866b04550fc5461058c398c2e3e509381ajeffhao } 213010037c866b04550fc5461058c398c2e3e509381ajeffhao 213113735955f39b3b304c37d2b2840663c131262c18Ian Rogers ptr_ = reinterpret_cast<const uint8_t*>(offsets); 213210037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 213310037c866b04550fc5461058c398c2e3e509381ajeffhao} 213410037c866b04550fc5461058c398c2e3e509381ajeffhao 213510037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterClassDataItem() { 213610037c866b04550fc5461058c398c2e3e509381ajeffhao ClassDataItemIterator it(*dex_file_, ptr_); 21375e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe bool success; 21385e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe uint16_t defining_class = FindFirstClassDataDefiner(ptr_, &success); 21395e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe if (!success) { 2140e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; 2141e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 214210037c866b04550fc5461058c398c2e3e509381ajeffhao 214310037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextStaticField() || it.HasNextInstanceField(); it.Next()) { 21445e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_FIELD(field, it.GetMemberIndex(), "inter_class_data_item field_id", return false) 2145e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(field->class_idx_ != defining_class)) { 21468d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for class_data_item field"); 214710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 214810037c866b04550fc5461058c398c2e3e509381ajeffhao } 214910037c866b04550fc5461058c398c2e3e509381ajeffhao } 215010037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextDirectMethod() || it.HasNextVirtualMethod(); it.Next()) { 215110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t code_off = it.GetMethodCodeItemOffset(); 215210037c866b04550fc5461058c398c2e3e509381ajeffhao if (code_off != 0 && !CheckOffsetToTypeMap(code_off, DexFile::kDexTypeCodeItem)) { 215310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 215410037c866b04550fc5461058c398c2e3e509381ajeffhao } 21555e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_METHOD(method, it.GetMemberIndex(), "inter_class_data_item method_id", return false) 2156e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(method->class_idx_ != defining_class)) { 21578d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for class_data_item method"); 215810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 215910037c866b04550fc5461058c398c2e3e509381ajeffhao } 216010037c866b04550fc5461058c398c2e3e509381ajeffhao } 216110037c866b04550fc5461058c398c2e3e509381ajeffhao 216210037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = it.EndDataPointer(); 216310037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 216410037c866b04550fc5461058c398c2e3e509381ajeffhao} 216510037c866b04550fc5461058c398c2e3e509381ajeffhao 216610037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterAnnotationsDirectoryItem() { 216710037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationsDirectoryItem* item = 216810037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationsDirectoryItem*>(ptr_); 21695e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe bool success; 21705e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe uint16_t defining_class = FindFirstAnnotationsDirectoryDefiner(ptr_, &success); 21715e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe if (!success) { 2172e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; 2173e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 217410037c866b04550fc5461058c398c2e3e509381ajeffhao 217510037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->class_annotations_off_ != 0 && 217610037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->class_annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 217710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 217810037c866b04550fc5461058c398c2e3e509381ajeffhao } 217910037c866b04550fc5461058c398c2e3e509381ajeffhao 218010037c866b04550fc5461058c398c2e3e509381ajeffhao // Field annotations follow immediately after the annotations directory. 218110037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldAnnotationsItem* field_item = 218210037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::FieldAnnotationsItem*>(item + 1); 218310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t field_count = item->fields_size_; 218410037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < field_count; i++) { 21855e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_FIELD(field, field_item->field_idx_, "inter_annotations_directory_item field_id", 21865e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe return false) 2187e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(field->class_idx_ != defining_class)) { 21888d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for field_annotation"); 218910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 219010037c866b04550fc5461058c398c2e3e509381ajeffhao } 219110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckOffsetToTypeMap(field_item->annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 219210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 219310037c866b04550fc5461058c398c2e3e509381ajeffhao } 219410037c866b04550fc5461058c398c2e3e509381ajeffhao field_item++; 219510037c866b04550fc5461058c398c2e3e509381ajeffhao } 219610037c866b04550fc5461058c398c2e3e509381ajeffhao 219710037c866b04550fc5461058c398c2e3e509381ajeffhao // Method annotations follow immediately after field annotations. 219810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodAnnotationsItem* method_item = 219910037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::MethodAnnotationsItem*>(field_item); 220010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t method_count = item->methods_size_; 220110037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < method_count; i++) { 2202e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_METHOD(method, method_item->method_idx_, "inter_annotations_directory_item method_id", 22035e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe return false) 2204e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(method->class_idx_ != defining_class)) { 22058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for method_annotation"); 220610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 220710037c866b04550fc5461058c398c2e3e509381ajeffhao } 220810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckOffsetToTypeMap(method_item->annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 220910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 221010037c866b04550fc5461058c398c2e3e509381ajeffhao } 221110037c866b04550fc5461058c398c2e3e509381ajeffhao method_item++; 221210037c866b04550fc5461058c398c2e3e509381ajeffhao } 221310037c866b04550fc5461058c398c2e3e509381ajeffhao 221410037c866b04550fc5461058c398c2e3e509381ajeffhao // Parameter annotations follow immediately after method annotations. 221510037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ParameterAnnotationsItem* parameter_item = 221610037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::ParameterAnnotationsItem*>(method_item); 221710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameter_count = item->parameters_size_; 221810037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < parameter_count; i++) { 2219e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_METHOD(parameter_method, parameter_item->method_idx_, 22205e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe "inter_annotations_directory_item parameter method_id", return false) 2221e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(parameter_method->class_idx_ != defining_class)) { 22228d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for parameter_annotation"); 222310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 222410037c866b04550fc5461058c398c2e3e509381ajeffhao } 22252b87ddf36abff711fa2233c49bffc7ceb03b15d7Dragos Sbirlea if (!CheckOffsetToTypeMap(parameter_item->annotations_off_, 22262b87ddf36abff711fa2233c49bffc7ceb03b15d7Dragos Sbirlea DexFile::kDexTypeAnnotationSetRefList)) { 222710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 222810037c866b04550fc5461058c398c2e3e509381ajeffhao } 222910037c866b04550fc5461058c398c2e3e509381ajeffhao parameter_item++; 223010037c866b04550fc5461058c398c2e3e509381ajeffhao } 223110037c866b04550fc5461058c398c2e3e509381ajeffhao 223213735955f39b3b304c37d2b2840663c131262c18Ian Rogers ptr_ = reinterpret_cast<const uint8_t*>(parameter_item); 223310037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 223410037c866b04550fc5461058c398c2e3e509381ajeffhao} 223510037c866b04550fc5461058c398c2e3e509381ajeffhao 22368a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckInterSectionIterate(size_t offset, uint32_t count, uint16_t type) { 223710037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the right alignment mask for the type of section. 22388a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t alignment_mask; 223910037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 224010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 224110037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint8_t) - 1; 224210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 224310037c866b04550fc5461058c398c2e3e509381ajeffhao default: 224410037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint32_t) - 1; 224510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 224610037c866b04550fc5461058c398c2e3e509381ajeffhao } 224710037c866b04550fc5461058c398c2e3e509381ajeffhao 224810037c866b04550fc5461058c398c2e3e509381ajeffhao // Iterate through the items in the section. 22492cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier previous_item_ = nullptr; 225010037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < count; i++) { 225110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t new_offset = (offset + alignment_mask) & ~alignment_mask; 225230fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers ptr_ = begin_ + new_offset; 225313735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* prev_ptr = ptr_; 225410037c866b04550fc5461058c398c2e3e509381ajeffhao 225510037c866b04550fc5461058c398c2e3e509381ajeffhao // Check depending on the section type. 225610037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 225710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: { 225810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterStringIdItem()) { 225910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 226010037c866b04550fc5461058c398c2e3e509381ajeffhao } 226110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 226210037c866b04550fc5461058c398c2e3e509381ajeffhao } 226310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: { 226410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterTypeIdItem()) { 226510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 226610037c866b04550fc5461058c398c2e3e509381ajeffhao } 226710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 226810037c866b04550fc5461058c398c2e3e509381ajeffhao } 226910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: { 227010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterProtoIdItem()) { 227110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 227210037c866b04550fc5461058c398c2e3e509381ajeffhao } 227310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 227410037c866b04550fc5461058c398c2e3e509381ajeffhao } 227510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: { 227610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterFieldIdItem()) { 227710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 227810037c866b04550fc5461058c398c2e3e509381ajeffhao } 227910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 228010037c866b04550fc5461058c398c2e3e509381ajeffhao } 228110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: { 228210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterMethodIdItem()) { 228310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 228410037c866b04550fc5461058c398c2e3e509381ajeffhao } 228510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 228610037c866b04550fc5461058c398c2e3e509381ajeffhao } 228710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: { 228810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterClassDefItem()) { 228910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 229010037c866b04550fc5461058c398c2e3e509381ajeffhao } 229110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 229210037c866b04550fc5461058c398c2e3e509381ajeffhao } 229310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: { 229410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterAnnotationSetRefList()) { 229510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 229610037c866b04550fc5461058c398c2e3e509381ajeffhao } 229710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 229810037c866b04550fc5461058c398c2e3e509381ajeffhao } 229910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: { 230010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterAnnotationSetItem()) { 230110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 230210037c866b04550fc5461058c398c2e3e509381ajeffhao } 230310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 230410037c866b04550fc5461058c398c2e3e509381ajeffhao } 230510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: { 230610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterClassDataItem()) { 230710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 230810037c866b04550fc5461058c398c2e3e509381ajeffhao } 230910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 231010037c866b04550fc5461058c398c2e3e509381ajeffhao } 231110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: { 231210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterAnnotationsDirectoryItem()) { 231310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 231410037c866b04550fc5461058c398c2e3e509381ajeffhao } 231510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 231610037c866b04550fc5461058c398c2e3e509381ajeffhao } 231710037c866b04550fc5461058c398c2e3e509381ajeffhao default: 23188d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 231910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 232010037c866b04550fc5461058c398c2e3e509381ajeffhao } 232110037c866b04550fc5461058c398c2e3e509381ajeffhao 232210037c866b04550fc5461058c398c2e3e509381ajeffhao previous_item_ = prev_ptr; 23238a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers offset = ptr_ - begin_; 232410037c866b04550fc5461058c398c2e3e509381ajeffhao } 232510037c866b04550fc5461058c398c2e3e509381ajeffhao 232610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 232710037c866b04550fc5461058c398c2e3e509381ajeffhao} 232810037c866b04550fc5461058c398c2e3e509381ajeffhao 232910037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterSection() { 233030fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers const DexFile::MapList* map = reinterpret_cast<const DexFile::MapList*>(begin_ + header_->map_off_); 233110037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MapItem* item = map->list_; 233210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = map->size_; 233310037c866b04550fc5461058c398c2e3e509381ajeffhao 233410037c866b04550fc5461058c398c2e3e509381ajeffhao // Cross check the items listed in the map. 233510037c866b04550fc5461058c398c2e3e509381ajeffhao while (count--) { 233610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_offset = item->offset_; 233710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_count = item->size_; 233810037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t type = item->type_; 233910037c866b04550fc5461058c398c2e3e509381ajeffhao 234010037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 234110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: 234210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMapList: 234310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: 234410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: 234510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: 234610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: 234710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: 234810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: 234910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 235010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 235110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 235210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 235310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 235410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 235510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 235610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: 235710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: 235810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 235910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: { 236010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterSectionIterate(section_offset, section_count, type)) { 236110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 236210037c866b04550fc5461058c398c2e3e509381ajeffhao } 236310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 236410037c866b04550fc5461058c398c2e3e509381ajeffhao } 236510037c866b04550fc5461058c398c2e3e509381ajeffhao default: 23668d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 236710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 236810037c866b04550fc5461058c398c2e3e509381ajeffhao } 236910037c866b04550fc5461058c398c2e3e509381ajeffhao 237010037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 237110037c866b04550fc5461058c398c2e3e509381ajeffhao } 237210037c866b04550fc5461058c398c2e3e509381ajeffhao 237310037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 237410037c866b04550fc5461058c398c2e3e509381ajeffhao} 237510037c866b04550fc5461058c398c2e3e509381ajeffhao 237610037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::Verify() { 237710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the header. 237810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckHeader()) { 237910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 238010037c866b04550fc5461058c398c2e3e509381ajeffhao } 238110037c866b04550fc5461058c398c2e3e509381ajeffhao 238210037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the map section. 238310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckMap()) { 238410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 238510037c866b04550fc5461058c398c2e3e509381ajeffhao } 238610037c866b04550fc5461058c398c2e3e509381ajeffhao 238710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check structure within remaining sections. 238810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraSection()) { 238910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 239010037c866b04550fc5461058c398c2e3e509381ajeffhao } 239110037c866b04550fc5461058c398c2e3e509381ajeffhao 239210037c866b04550fc5461058c398c2e3e509381ajeffhao // Check references from one section to another. 239310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterSection()) { 239410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 239510037c866b04550fc5461058c398c2e3e509381ajeffhao } 239610037c866b04550fc5461058c398c2e3e509381ajeffhao 239710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 239810037c866b04550fc5461058c398c2e3e509381ajeffhao} 239910037c866b04550fc5461058c398c2e3e509381ajeffhao 24008d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersvoid DexFileVerifier::ErrorStringPrintf(const char* fmt, ...) { 24018d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers va_list ap; 24028d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers va_start(ap, fmt); 24038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers DCHECK(failure_reason_.empty()) << failure_reason_; 24048d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers failure_reason_ = StringPrintf("Failure to verify dex file '%s': ", location_); 24058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers StringAppendV(&failure_reason_, fmt, ap); 24068d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers va_end(ap); 24078d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers} 24088d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers 2409e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe// Fields and methods may have only one of public/protected/private. 2410e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampestatic bool CheckAtMostOneOfPublicProtectedPrivate(uint32_t flags) { 2411e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe size_t count = (((flags & kAccPublic) == 0) ? 0 : 1) + 2412e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (((flags & kAccProtected) == 0) ? 0 : 1) + 2413e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (((flags & kAccPrivate) == 0) ? 0 : 1); 2414e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return count <= 1; 2415e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 2416e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2417c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe// Helper functions to retrieve names from the dex file. We do not want to rely on DexFile 2418c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe// functionality, as we're still verifying the dex file. begin and header correspond to the 2419c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe// underscored variants in the DexFileVerifier. 2420c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2421c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampestatic std::string GetStringOrError(const uint8_t* const begin, 2422c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe const DexFile::Header* const header, 2423c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe uint32_t string_idx) { 2424fd175b1020f1f65388a06c5fcbac78d78f6c645cVladimir Marko // The `string_idx` is not guaranteed to be valid yet. 2425fd175b1020f1f65388a06c5fcbac78d78f6c645cVladimir Marko if (header->string_ids_size_ <= string_idx) { 2426c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe return "(error)"; 2427c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe } 2428c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2429c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe const DexFile::StringId* string_id = 2430c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe reinterpret_cast<const DexFile::StringId*>(begin + header->string_ids_off_) + string_idx; 2431c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2432c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe // Assume that the data is OK at this point. String data has been checked at this point. 2433c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2434c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe const uint8_t* ptr = begin + string_id->string_data_off_; 2435c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe DecodeUnsignedLeb128(&ptr); 2436c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe return reinterpret_cast<const char*>(ptr); 2437c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe} 2438c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2439c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampestatic std::string GetClassOrError(const uint8_t* const begin, 2440c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe const DexFile::Header* const header, 2441c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe uint32_t class_idx) { 2442fd175b1020f1f65388a06c5fcbac78d78f6c645cVladimir Marko // The `class_idx` is either `FieldId::class_idx_` or `MethodId::class_idx_` and 2443fd175b1020f1f65388a06c5fcbac78d78f6c645cVladimir Marko // it has already been checked in `DexFileVerifier::CheckClassDataItemField()` 2444fd175b1020f1f65388a06c5fcbac78d78f6c645cVladimir Marko // or `DexFileVerifier::CheckClassDataItemMethod()`, respectively, to match 2445fd175b1020f1f65388a06c5fcbac78d78f6c645cVladimir Marko // a valid defining class. 2446fd175b1020f1f65388a06c5fcbac78d78f6c645cVladimir Marko CHECK_LT(class_idx, header->type_ids_size_); 2447c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2448c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe const DexFile::TypeId* type_id = 2449c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe reinterpret_cast<const DexFile::TypeId*>(begin + header->type_ids_off_) + class_idx; 2450c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2451c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe // Assume that the data is OK at this point. Type id offsets have been checked at this point. 2452c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2453c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe return GetStringOrError(begin, header, type_id->descriptor_idx_); 2454c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe} 2455c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2456c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampestatic std::string GetFieldDescriptionOrError(const uint8_t* const begin, 2457c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe const DexFile::Header* const header, 2458c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe uint32_t idx) { 2459fd175b1020f1f65388a06c5fcbac78d78f6c645cVladimir Marko // The `idx` has already been checked in `DexFileVerifier::CheckClassDataItemField()`. 2460fd175b1020f1f65388a06c5fcbac78d78f6c645cVladimir Marko CHECK_LT(idx, header->field_ids_size_); 2461c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2462c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe const DexFile::FieldId* field_id = 2463c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe reinterpret_cast<const DexFile::FieldId*>(begin + header->field_ids_off_) + idx; 2464c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2465c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe // Assume that the data is OK at this point. Field id offsets have been checked at this point. 2466c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2467c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe std::string class_name = GetClassOrError(begin, header, field_id->class_idx_); 2468c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe std::string field_name = GetStringOrError(begin, header, field_id->name_idx_); 2469c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2470c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe return class_name + "." + field_name; 2471c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe} 2472c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2473c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampestatic std::string GetMethodDescriptionOrError(const uint8_t* const begin, 2474c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe const DexFile::Header* const header, 2475c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe uint32_t idx) { 2476fd175b1020f1f65388a06c5fcbac78d78f6c645cVladimir Marko // The `idx` has already been checked in `DexFileVerifier::CheckClassDataItemMethod()`. 2477fd175b1020f1f65388a06c5fcbac78d78f6c645cVladimir Marko CHECK_LT(idx, header->method_ids_size_); 2478c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2479c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe const DexFile::MethodId* method_id = 2480c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe reinterpret_cast<const DexFile::MethodId*>(begin + header->method_ids_off_) + idx; 2481c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2482c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe // Assume that the data is OK at this point. Method id offsets have been checked at this point. 2483c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2484c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe std::string class_name = GetClassOrError(begin, header, method_id->class_idx_); 2485c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe std::string method_name = GetStringOrError(begin, header, method_id->name_idx_); 2486c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2487c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe return class_name + "." + method_name; 2488c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe} 2489c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe 2490c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampebool DexFileVerifier::CheckFieldAccessFlags(uint32_t idx, 2491c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe uint32_t field_access_flags, 2492e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t class_access_flags, 2493e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::string* error_msg) { 2494e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Generally sort out >16-bit flags. 2495e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((field_access_flags & ~kAccJavaFlagsMask) != 0) { 2496c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = StringPrintf("Bad field access_flags for %s: %x(%s)", 2497c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetFieldDescriptionOrError(begin_, header_, idx).c_str(), 2498c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe field_access_flags, 2499c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe PrettyJavaAccessFlags(field_access_flags).c_str()); 2500e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2501e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2502e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2503e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Flags allowed on fields, in general. Other lower-16-bit flags are to be ignored. 2504e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr uint32_t kFieldAccessFlags = kAccPublic | 2505e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccPrivate | 2506e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccProtected | 2507e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccStatic | 2508e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccFinal | 2509e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccVolatile | 2510e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccTransient | 2511e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccSynthetic | 2512e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccEnum; 2513e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2514e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Fields may have only one of public/protected/final. 2515e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckAtMostOneOfPublicProtectedPrivate(field_access_flags)) { 2516c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = StringPrintf("Field may have only one of public/protected/private, %s: %x(%s)", 2517c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetFieldDescriptionOrError(begin_, header_, idx).c_str(), 2518c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe field_access_flags, 2519c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe PrettyJavaAccessFlags(field_access_flags).c_str()); 2520e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2521e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2522e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2523e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Interfaces have a pretty restricted list. 2524e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((class_access_flags & kAccInterface) != 0) { 2525e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Interface fields must be public final static. 2526e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr uint32_t kPublicFinalStatic = kAccPublic | kAccFinal | kAccStatic; 2527e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((field_access_flags & kPublicFinalStatic) != kPublicFinalStatic) { 2528c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = StringPrintf("Interface field is not public final static, %s: %x(%s)", 2529c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetFieldDescriptionOrError(begin_, header_, idx).c_str(), 2530c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe field_access_flags, 2531c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe PrettyJavaAccessFlags(field_access_flags).c_str()); 2532f0fe04cbaf189702e9dad7252ed834cb4735c877Alex Light if (header_->GetVersion() >= DexFile::kDefaultMethodsVersion) { 253376ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe return false; 253476ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe } else { 253576ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe // Allow in older versions, but warn. 253676ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe LOG(WARNING) << "This dex file is invalid and will be rejected in the future. Error is: " 253776ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe << *error_msg; 253876ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe } 2539e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2540e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Interface fields may be synthetic, but may not have other flags. 2541e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr uint32_t kDisallowed = ~(kPublicFinalStatic | kAccSynthetic); 2542e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((field_access_flags & kFieldAccessFlags & kDisallowed) != 0) { 2543c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = StringPrintf("Interface field has disallowed flag, %s: %x(%s)", 2544c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetFieldDescriptionOrError(begin_, header_, idx).c_str(), 2545c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe field_access_flags, 2546c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe PrettyJavaAccessFlags(field_access_flags).c_str()); 2547f0fe04cbaf189702e9dad7252ed834cb4735c877Alex Light if (header_->GetVersion() >= DexFile::kDefaultMethodsVersion) { 254876ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe return false; 254976ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe } else { 255076ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe // Allow in older versions, but warn. 255176ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe LOG(WARNING) << "This dex file is invalid and will be rejected in the future. Error is: " 255276ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe << *error_msg; 255376ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe } 2554e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2555e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 2556e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2557e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2558e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Volatile fields may not be final. 2559e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr uint32_t kVolatileFinal = kAccVolatile | kAccFinal; 2560e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((field_access_flags & kVolatileFinal) == kVolatileFinal) { 2561c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = StringPrintf("Fields may not be volatile and final: %s", 2562c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetFieldDescriptionOrError(begin_, header_, idx).c_str()); 2563e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2564e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2565e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2566e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 2567e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 2568e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2569e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe// Try to find the name of the method with the given index. We do not want to rely on DexFile 2570e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe// infrastructure at this point, so do it all by hand. begin and header correspond to begin_ and 2571e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe// header_ of the DexFileVerifier. str will contain the pointer to the method name on success 2572e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe// (flagged by the return value), otherwise error_msg will contain an error string. 2573e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampestatic bool FindMethodName(uint32_t method_index, 2574e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const uint8_t* begin, 2575e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const DexFile::Header* header, 2576e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const char** str, 2577e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::string* error_msg) { 2578e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (method_index >= header->method_ids_size_) { 2579e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = "Method index not available for method flags verification"; 2580e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2581e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2582e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t string_idx = 2583e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (reinterpret_cast<const DexFile::MethodId*>(begin + header->method_ids_off_) + 2584e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_index)->name_idx_; 2585e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (string_idx >= header->string_ids_size_) { 2586e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = "String index not available for method flags verification"; 2587e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2588e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2589e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t string_off = 2590e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (reinterpret_cast<const DexFile::StringId*>(begin + header->string_ids_off_) + string_idx)-> 2591e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe string_data_off_; 2592e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (string_off >= header->file_size_) { 2593e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = "String offset out of bounds for method flags verification"; 2594e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2595e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2596e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const uint8_t* str_data_ptr = begin + string_off; 2597e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe DecodeUnsignedLeb128(&str_data_ptr); 2598e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *str = reinterpret_cast<const char*>(str_data_ptr); 2599e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 2600e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 2601e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2602e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::CheckMethodAccessFlags(uint32_t method_index, 2603e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t method_access_flags, 2604e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t class_access_flags, 2605e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool has_code, 2606e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool expect_direct, 2607e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::string* error_msg) { 2608e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Generally sort out >16-bit flags, except dex knows Constructor and DeclaredSynchronized. 2609e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr uint32_t kAllMethodFlags = 2610e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccJavaFlagsMask | kAccConstructor | kAccDeclaredSynchronized; 2611e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((method_access_flags & ~kAllMethodFlags) != 0) { 2612c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = StringPrintf("Bad method access_flags for %s: %x", 2613c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetMethodDescriptionOrError(begin_, header_, method_index).c_str(), 2614c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe method_access_flags); 2615e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2616e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2617e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2618e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Flags allowed on fields, in general. Other lower-16-bit flags are to be ignored. 2619e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr uint32_t kMethodAccessFlags = kAccPublic | 2620e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccPrivate | 2621e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccProtected | 2622e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccStatic | 2623e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccFinal | 2624e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccSynthetic | 2625e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccSynchronized | 2626e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccBridge | 2627e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccVarargs | 2628e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccNative | 2629e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccAbstract | 2630e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccStrict; 2631e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2632e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Methods may have only one of public/protected/final. 2633e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckAtMostOneOfPublicProtectedPrivate(method_access_flags)) { 2634c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = StringPrintf("Method may have only one of public/protected/private, %s: %x", 2635c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetMethodDescriptionOrError(begin_, header_, method_index).c_str(), 2636e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_access_flags); 2637e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2638e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2639e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2640e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Try to find the name, to check for constructor properties. 2641e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const char* str; 2642e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!FindMethodName(method_index, begin_, header_, &str, error_msg)) { 2643e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2644e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2645e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool is_init_by_name = false; 2646e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr const char* kInitName = "<init>"; 2647e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe size_t str_offset = (reinterpret_cast<const uint8_t*>(str) - begin_); 2648e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (header_->file_size_ - str_offset >= sizeof(kInitName)) { 2649e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe is_init_by_name = strcmp(kInitName, str) == 0; 2650e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2651e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool is_clinit_by_name = false; 2652e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr const char* kClinitName = "<clinit>"; 2653e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (header_->file_size_ - str_offset >= sizeof(kClinitName)) { 2654e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe is_clinit_by_name = strcmp(kClinitName, str) == 0; 2655e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2656e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool is_constructor = is_init_by_name || is_clinit_by_name; 2657e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2658e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Only methods named "<clinit>" or "<init>" may be marked constructor. Note: we cannot enforce 2659e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // the reverse for backwards compatibility reasons. 2660e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (((method_access_flags & kAccConstructor) != 0) && !is_constructor) { 2661c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = 2662c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe StringPrintf("Method %" PRIu32 "(%s) is marked constructor, but doesn't match name", 2663c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe method_index, 2664c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetMethodDescriptionOrError(begin_, header_, method_index).c_str()); 2665e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2666e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2667e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check that the static constructor (= static initializer) is named "<clinit>" and that the 2668e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // instance constructor is called "<init>". 2669e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (is_constructor) { 2670e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool is_static = (method_access_flags & kAccStatic) != 0; 2671e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (is_static ^ is_clinit_by_name) { 2672c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = StringPrintf("Constructor %" PRIu32 "(%s) is not flagged correctly wrt/ static.", 2673c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe method_index, 2674c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetMethodDescriptionOrError(begin_, header_, method_index).c_str()); 26758d8118a1e9fbb0413b7cf985630ffa318d0fbb7cAlex Light if (header_->GetVersion() >= DexFile::kDefaultMethodsVersion) { 26768d8118a1e9fbb0413b7cf985630ffa318d0fbb7cAlex Light return false; 26778d8118a1e9fbb0413b7cf985630ffa318d0fbb7cAlex Light } else { 26788d8118a1e9fbb0413b7cf985630ffa318d0fbb7cAlex Light // Allow in older versions, but warn. 26798d8118a1e9fbb0413b7cf985630ffa318d0fbb7cAlex Light LOG(WARNING) << "This dex file is invalid and will be rejected in the future. Error is: " 26808d8118a1e9fbb0413b7cf985630ffa318d0fbb7cAlex Light << *error_msg; 26818d8118a1e9fbb0413b7cf985630ffa318d0fbb7cAlex Light } 2682e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2683e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2684e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check that static and private methods, as well as constructors, are in the direct methods list, 2685e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // and other methods in the virtual methods list. 2686e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool is_direct = (method_access_flags & (kAccStatic | kAccPrivate)) != 0 || is_constructor; 2687e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (is_direct != expect_direct) { 2688c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = StringPrintf("Direct/virtual method %" PRIu32 "(%s) not in expected list %d", 2689e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_index, 2690c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetMethodDescriptionOrError(begin_, header_, method_index).c_str(), 2691e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe expect_direct); 2692e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2693e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2694e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2695e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2696e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // From here on out it is easier to mask out the bits we're supposed to ignore. 2697e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_access_flags &= kMethodAccessFlags; 2698e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2699565bc96291623bf617aef40739247b224188fd16Alex Light // Interfaces are special. 2700565bc96291623bf617aef40739247b224188fd16Alex Light if ((class_access_flags & kAccInterface) != 0) { 2701f0fe04cbaf189702e9dad7252ed834cb4735c877Alex Light // Non-static interface methods must be public or private. 2702f0fe04cbaf189702e9dad7252ed834cb4735c877Alex Light uint32_t desired_flags = (kAccPublic | kAccStatic); 2703f0fe04cbaf189702e9dad7252ed834cb4735c877Alex Light if (dex_file_->GetVersion() >= DexFile::kDefaultMethodsVersion) { 2704f0fe04cbaf189702e9dad7252ed834cb4735c877Alex Light desired_flags |= kAccPrivate; 2705f0fe04cbaf189702e9dad7252ed834cb4735c877Alex Light } 2706f0fe04cbaf189702e9dad7252ed834cb4735c877Alex Light if ((method_access_flags & desired_flags) == 0) { 2707565bc96291623bf617aef40739247b224188fd16Alex Light *error_msg = StringPrintf("Interface virtual method %" PRIu32 "(%s) is not public", 2708565bc96291623bf617aef40739247b224188fd16Alex Light method_index, 2709565bc96291623bf617aef40739247b224188fd16Alex Light GetMethodDescriptionOrError(begin_, header_, method_index).c_str()); 2710f0fe04cbaf189702e9dad7252ed834cb4735c877Alex Light if (header_->GetVersion() >= DexFile::kDefaultMethodsVersion) { 2711565bc96291623bf617aef40739247b224188fd16Alex Light return false; 2712565bc96291623bf617aef40739247b224188fd16Alex Light } else { 2713565bc96291623bf617aef40739247b224188fd16Alex Light // Allow in older versions, but warn. 2714565bc96291623bf617aef40739247b224188fd16Alex Light LOG(WARNING) << "This dex file is invalid and will be rejected in the future. Error is: " 2715565bc96291623bf617aef40739247b224188fd16Alex Light << *error_msg; 2716565bc96291623bf617aef40739247b224188fd16Alex Light } 2717565bc96291623bf617aef40739247b224188fd16Alex Light } 2718565bc96291623bf617aef40739247b224188fd16Alex Light } 2719565bc96291623bf617aef40739247b224188fd16Alex Light 2720e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // If there aren't any instructions, make sure that's expected. 2721e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!has_code) { 2722e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Only native or abstract methods may not have code. 2723e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((method_access_flags & (kAccNative | kAccAbstract)) == 0) { 2724c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = StringPrintf("Method %" PRIu32 "(%s) has no code, but is not marked native or " 2725e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe "abstract", 2726c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe method_index, 2727c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetMethodDescriptionOrError(begin_, header_, method_index).c_str()); 2728e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2729e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2730e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Constructors must always have code. 2731e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (is_constructor) { 2732c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = StringPrintf("Constructor %u(%s) must not be abstract or native", 2733c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe method_index, 2734c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetMethodDescriptionOrError(begin_, header_, method_index).c_str()); 27358d8118a1e9fbb0413b7cf985630ffa318d0fbb7cAlex Light if (header_->GetVersion() >= DexFile::kDefaultMethodsVersion) { 27368d8118a1e9fbb0413b7cf985630ffa318d0fbb7cAlex Light return false; 27378d8118a1e9fbb0413b7cf985630ffa318d0fbb7cAlex Light } else { 27388d8118a1e9fbb0413b7cf985630ffa318d0fbb7cAlex Light // Allow in older versions, but warn. 27398d8118a1e9fbb0413b7cf985630ffa318d0fbb7cAlex Light LOG(WARNING) << "This dex file is invalid and will be rejected in the future. Error is: " 27408d8118a1e9fbb0413b7cf985630ffa318d0fbb7cAlex Light << *error_msg; 27418d8118a1e9fbb0413b7cf985630ffa318d0fbb7cAlex Light } 2742e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2743e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((method_access_flags & kAccAbstract) != 0) { 2744e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Abstract methods are not allowed to have the following flags. 2745e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr uint32_t kForbidden = 2746e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccPrivate | kAccStatic | kAccFinal | kAccNative | kAccStrict | kAccSynchronized; 2747e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((method_access_flags & kForbidden) != 0) { 2748c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = StringPrintf("Abstract method %" PRIu32 "(%s) has disallowed access flags %x", 2749c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe method_index, 2750c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetMethodDescriptionOrError(begin_, header_, method_index).c_str(), 2751c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe method_access_flags); 2752e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2753e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 275497b113596576ee026c9d3e100e472e343bfda7faAndreas Gampe // Abstract methods should be in an abstract class or interface. 2755e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((class_access_flags & (kAccInterface | kAccAbstract)) == 0) { 2756c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe LOG(WARNING) << "Method " << GetMethodDescriptionOrError(begin_, header_, method_index) 275797b113596576ee026c9d3e100e472e343bfda7faAndreas Gampe << " is abstract, but the declaring class is neither abstract nor an " 275897b113596576ee026c9d3e100e472e343bfda7faAndreas Gampe << "interface in dex file " 275997b113596576ee026c9d3e100e472e343bfda7faAndreas Gampe << dex_file_->GetLocation(); 2760e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2761e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2762e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Interfaces are special. 2763e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((class_access_flags & kAccInterface) != 0) { 2764565bc96291623bf617aef40739247b224188fd16Alex Light // Interface methods without code must be abstract. 2765e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((method_access_flags & (kAccPublic | kAccAbstract)) != (kAccPublic | kAccAbstract)) { 2766c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = StringPrintf("Interface method %" PRIu32 "(%s) is not public and abstract", 2767c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe method_index, 2768c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetMethodDescriptionOrError(begin_, header_, method_index).c_str()); 2769f0fe04cbaf189702e9dad7252ed834cb4735c877Alex Light if (header_->GetVersion() >= DexFile::kDefaultMethodsVersion) { 277076ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe return false; 277176ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe } else { 277276ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe // Allow in older versions, but warn. 277376ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe LOG(WARNING) << "This dex file is invalid and will be rejected in the future. Error is: " 277476ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe << *error_msg; 277576ed99d5ec208d5adcd63b41c2c290194ee0ecf7Andreas Gampe } 2776e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2777e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // At this point, we know the method is public and abstract. This means that all the checks 2778e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // for invalid combinations above applies. In addition, interface methods must not be 2779e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // protected. This is caught by the check for only-one-of-public-protected-private. 2780e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2781e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 2782e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2783e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2784e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // When there's code, the method must not be native or abstract. 2785e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((method_access_flags & (kAccNative | kAccAbstract)) != 0) { 2786c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = StringPrintf("Method %" PRIu32 "(%s) has code, but is marked native or abstract", 2787c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe method_index, 2788c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetMethodDescriptionOrError(begin_, header_, method_index).c_str()); 2789e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2790e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2791e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2792e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Instance constructors must not be synchronized and a few other flags. 2793e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (is_init_by_name) { 2794e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe static constexpr uint32_t kInitAllowed = 2795e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccPrivate | kAccProtected | kAccPublic | kAccStrict | kAccVarargs | kAccSynthetic; 2796e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((method_access_flags & ~kInitAllowed) != 0) { 2797c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe *error_msg = StringPrintf("Constructor %" PRIu32 "(%s) flagged inappropriately %x", 2798e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_index, 2799c9f0ba1a4a2c9366ffc2dc2f9c2d8d3f09bb2112Andreas Gampe GetMethodDescriptionOrError(begin_, header_, method_index).c_str(), 2800e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_access_flags); 2801e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2802e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2803e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2804e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2805e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 2806e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 2807e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 280810037c866b04550fc5461058c398c2e3e509381ajeffhao} // namespace art 2809