dex_file_verifier.cc revision 0f8e0723d67bd75125705b2707c36927beabd886
12faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes/* 22faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * Copyright (C) 2011 The Android Open Source Project 32faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * 42faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * Licensed under the Apache License, Version 2.0 (the "License"); 52faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * you may not use this file except in compliance with the License. 62faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * You may obtain a copy of the License at 72faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * 82faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * http://www.apache.org/licenses/LICENSE-2.0 92faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * 102faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * Unless required by applicable law or agreed to in writing, software 112faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * distributed under the License is distributed on an "AS IS" BASIS, 122faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 132faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * See the License for the specific language governing permissions and 142faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * limitations under the License. 152faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes */ 1610037c866b04550fc5461058c398c2e3e509381ajeffhao 1710037c866b04550fc5461058c398c2e3e509381ajeffhao#include "dex_file_verifier.h" 1810037c866b04550fc5461058c398c2e3e509381ajeffhao 19e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe#include <inttypes.h> 2092572be7f754c213e615a62955cc5f65ca8c0c0eNarayan Kamath#include <zlib.h> 21e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 22700a402244a1a423da4f3ba8032459f4b65fa18fIan Rogers#include <memory> 2392572be7f754c213e615a62955cc5f65ca8c0c0eNarayan Kamath 24e222ee0b794f941af4fb1b32fb8224e32942ea7bElliott Hughes#include "base/stringprintf.h" 254f6ad8ab428038129b2d0d6c40b7fd625cca15e1Ian Rogers#include "dex_file-inl.h" 26eb7c144a6aff7da673ba53d501c46f00311d4d7fAlex Light#include "experimental_flags.h" 2710037c866b04550fc5461058c398c2e3e509381ajeffhao#include "leb128.h" 28eb7c144a6aff7da673ba53d501c46f00311d4d7fAlex Light#include "runtime.h" 29a0e180632411f7fe0edf454e571c42209ee7b540Elliott Hughes#include "safe_map.h" 30a67249065e4c9b3cf4a7c081d95a78df28291ee9Ian Rogers#include "utf-inl.h" 312dd0e2cea360bc9206eb88ecc40d259e796c239dIan Rogers#include "utils.h" 3210037c866b04550fc5461058c398c2e3e509381ajeffhao 3310037c866b04550fc5461058c398c2e3e509381ajeffhaonamespace art { 3410037c866b04550fc5461058c398c2e3e509381ajeffhao 3510037c866b04550fc5461058c398c2e3e509381ajeffhaostatic uint32_t MapTypeToBitMask(uint32_t map_type) { 3610037c866b04550fc5461058c398c2e3e509381ajeffhao switch (map_type) { 3710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: return 1 << 0; 3810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: return 1 << 1; 3910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: return 1 << 2; 4010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: return 1 << 3; 4110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: return 1 << 4; 4210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: return 1 << 5; 4310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: return 1 << 6; 4410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMapList: return 1 << 7; 4510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: return 1 << 8; 4610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: return 1 << 9; 4710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: return 1 << 10; 4810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: return 1 << 11; 4910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: return 1 << 12; 5010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: return 1 << 13; 5110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: return 1 << 14; 5210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: return 1 << 15; 5310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: return 1 << 16; 5410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: return 1 << 17; 5510037c866b04550fc5461058c398c2e3e509381ajeffhao } 5610037c866b04550fc5461058c398c2e3e509381ajeffhao return 0; 5710037c866b04550fc5461058c398c2e3e509381ajeffhao} 5810037c866b04550fc5461058c398c2e3e509381ajeffhao 5910037c866b04550fc5461058c398c2e3e509381ajeffhaostatic bool IsDataSectionType(uint32_t map_type) { 6010037c866b04550fc5461058c398c2e3e509381ajeffhao switch (map_type) { 6110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: 6210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 6310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 6410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 6510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 6610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 6710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 6810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 6910037c866b04550fc5461058c398c2e3e509381ajeffhao } 7010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 7110037c866b04550fc5461058c398c2e3e509381ajeffhao} 7210037c866b04550fc5461058c398c2e3e509381ajeffhao 73e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampeconst char* DexFileVerifier::CheckLoadStringByIdx(uint32_t idx, const char* error_string) { 74df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(!CheckIndex(idx, dex_file_->NumStringIds(), error_string))) { 75e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return nullptr; 76e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 77e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return dex_file_->StringDataByIdx(idx); 78e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe} 79e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 80e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampeconst char* DexFileVerifier::CheckLoadStringByTypeIdx(uint32_t type_idx, const char* error_string) { 81df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(!CheckIndex(type_idx, dex_file_->NumTypeIds(), error_string))) { 82e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return nullptr; 83e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 84e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe const DexFile::TypeId& type_id = dex_file_->GetTypeId(type_idx); 85e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe uint32_t idx = type_id.descriptor_idx_; 86e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return CheckLoadStringByIdx(idx, error_string); 87e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe} 88e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 89e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampeconst DexFile::FieldId* DexFileVerifier::CheckLoadFieldId(uint32_t idx, const char* error_string) { 90df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(!CheckIndex(idx, dex_file_->NumFieldIds(), error_string))) { 91e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return nullptr; 92e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 93e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return &dex_file_->GetFieldId(idx); 94e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe} 95e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 96e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampeconst DexFile::MethodId* DexFileVerifier::CheckLoadMethodId(uint32_t idx, const char* err_string) { 97df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(!CheckIndex(idx, dex_file_->NumMethodIds(), err_string))) { 98e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return nullptr; 99e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 100e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return &dex_file_->GetMethodId(idx); 101e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe} 102e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 103e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe// Helper macro to load string and return false on error. 104e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe#define LOAD_STRING(var, idx, error) \ 105e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe const char* var = CheckLoadStringByIdx(idx, error); \ 106df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(var == nullptr)) { \ 107e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; \ 108e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 109e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 110e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe// Helper macro to load string by type idx and return false on error. 111e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe#define LOAD_STRING_BY_TYPE(var, type_idx, error) \ 112e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe const char* var = CheckLoadStringByTypeIdx(type_idx, error); \ 113df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(var == nullptr)) { \ 114e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; \ 115e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 116e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 117e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe// Helper macro to load method id. Return last parameter on error. 1185e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe#define LOAD_METHOD(var, idx, error_string, error_stmt) \ 119e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe const DexFile::MethodId* var = CheckLoadMethodId(idx, error_string); \ 120df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(var == nullptr)) { \ 1215e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe error_stmt; \ 122e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 123e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 124e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe// Helper macro to load method id. Return last parameter on error. 1255e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe#define LOAD_FIELD(var, idx, fmt, error_stmt) \ 126e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe const DexFile::FieldId* var = CheckLoadFieldId(idx, fmt); \ 127df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(var == nullptr)) { \ 1285e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe error_stmt; \ 129e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 130e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 13113735955f39b3b304c37d2b2840663c131262c18Ian Rogersbool DexFileVerifier::Verify(const DexFile* dex_file, const uint8_t* begin, size_t size, 1328d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers const char* location, std::string* error_msg) { 133700a402244a1a423da4f3ba8032459f4b65fa18fIan Rogers std::unique_ptr<DexFileVerifier> verifier(new DexFileVerifier(dex_file, begin, size, location)); 1348d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (!verifier->Verify()) { 1358d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers *error_msg = verifier->FailureReason(); 1368d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers return false; 1378d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } 1388d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers return true; 1398d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers} 1408d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers 1418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckShortyDescriptorMatch(char shorty_char, const char* descriptor, 1428d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers bool is_return_type) { 14310037c866b04550fc5461058c398c2e3e509381ajeffhao switch (shorty_char) { 14410037c866b04550fc5461058c398c2e3e509381ajeffhao case 'V': 1458d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!is_return_type)) { 1468d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid use of void"); 14710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 14810037c866b04550fc5461058c398c2e3e509381ajeffhao } 149fc787ecd91127b2c8458afd94e5148e2ae51a1f5Ian Rogers FALLTHROUGH_INTENDED; 15010037c866b04550fc5461058c398c2e3e509381ajeffhao case 'B': 15110037c866b04550fc5461058c398c2e3e509381ajeffhao case 'C': 15210037c866b04550fc5461058c398c2e3e509381ajeffhao case 'D': 15310037c866b04550fc5461058c398c2e3e509381ajeffhao case 'F': 15410037c866b04550fc5461058c398c2e3e509381ajeffhao case 'I': 15510037c866b04550fc5461058c398c2e3e509381ajeffhao case 'J': 15610037c866b04550fc5461058c398c2e3e509381ajeffhao case 'S': 15710037c866b04550fc5461058c398c2e3e509381ajeffhao case 'Z': 1588d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((descriptor[0] != shorty_char) || (descriptor[1] != '\0'))) { 1598d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Shorty vs. primitive type mismatch: '%c', '%s'", 1608d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers shorty_char, descriptor); 16110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 16210037c866b04550fc5461058c398c2e3e509381ajeffhao } 16310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 16410037c866b04550fc5461058c398c2e3e509381ajeffhao case 'L': 1658d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((descriptor[0] != 'L') && (descriptor[0] != '['))) { 1668d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Shorty vs. type mismatch: '%c', '%s'", shorty_char, descriptor); 16710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 16810037c866b04550fc5461058c398c2e3e509381ajeffhao } 16910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 17010037c866b04550fc5461058c398c2e3e509381ajeffhao default: 1718d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad shorty character: '%c'", shorty_char); 17210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 17310037c866b04550fc5461058c398c2e3e509381ajeffhao } 17410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 17510037c866b04550fc5461058c398c2e3e509381ajeffhao} 17610037c866b04550fc5461058c398c2e3e509381ajeffhao 17750d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampebool DexFileVerifier::CheckListSize(const void* start, size_t count, size_t elem_size, 178d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe const char* label) { 17950d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe // Check that size is not 0. 18050d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe CHECK_NE(elem_size, 0U); 18150d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe 18213735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* range_start = reinterpret_cast<const uint8_t*>(start); 18313735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* file_start = reinterpret_cast<const uint8_t*>(begin_); 18450d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe 18550d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe // Check for overflow. 18650d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe uintptr_t max = 0 - 1; 18750d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe size_t available_bytes_till_end_of_mem = max - reinterpret_cast<uintptr_t>(start); 18850d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe size_t max_count = available_bytes_till_end_of_mem / elem_size; 18950d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (max_count < count) { 19050d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe ErrorStringPrintf("Overflow in range for %s: %zx for %zu@%zu", label, 19150d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe static_cast<size_t>(range_start - file_start), 19250d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe count, elem_size); 19350d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe return false; 19450d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe } 19550d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe 19613735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* range_end = range_start + count * elem_size; 19713735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* file_end = file_start + size_; 19850d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (UNLIKELY((range_start < file_start) || (range_end > file_end))) { 19950d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe // Note: these two tests are enough as we make sure above that there's no overflow. 2008a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Bad range for %s: %zx to %zx", label, 201e3d5581266301e6a672af6233220037abf52fea1Ian Rogers static_cast<size_t>(range_start - file_start), 202e3d5581266301e6a672af6233220037abf52fea1Ian Rogers static_cast<size_t>(range_end - file_start)); 20310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 20410037c866b04550fc5461058c398c2e3e509381ajeffhao } 20510037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 20610037c866b04550fc5461058c398c2e3e509381ajeffhao} 20710037c866b04550fc5461058c398c2e3e509381ajeffhao 20813735955f39b3b304c37d2b2840663c131262c18Ian Rogersbool DexFileVerifier::CheckList(size_t element_size, const char* label, const uint8_t* *ptr) { 209d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe // Check that the list is available. The first 4B are the count. 210d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckListSize(*ptr, 1, 4U, label)) { 211d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return false; 212d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 213d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 214d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe uint32_t count = *reinterpret_cast<const uint32_t*>(*ptr); 215d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (count > 0) { 216d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckListSize(*ptr + 4, count, element_size, label)) { 217d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return false; 218d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 219d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 220d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 221d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe *ptr += 4 + count * element_size; 222d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return true; 223d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe} 224d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 2258d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckIndex(uint32_t field, uint32_t limit, const char* label) { 2268d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(field >= limit)) { 2278d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad index for %s: %x >= %x", label, field, limit); 22810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 22910037c866b04550fc5461058c398c2e3e509381ajeffhao } 23010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 23110037c866b04550fc5461058c398c2e3e509381ajeffhao} 23210037c866b04550fc5461058c398c2e3e509381ajeffhao 233d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampebool DexFileVerifier::CheckValidOffsetAndSize(uint32_t offset, uint32_t size, const char* label) { 234d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (size == 0) { 235d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (offset != 0) { 236d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe ErrorStringPrintf("Offset(%d) should be zero when size is zero for %s.", offset, label); 237d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return false; 238d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 239d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 240d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (size_ <= offset) { 241d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe ErrorStringPrintf("Offset(%d) should be within file size(%zu) for %s.", offset, size_, label); 242d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return false; 243d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 244d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return true; 245d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe} 246d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 2478d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckHeader() { 248f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao // Check file size from the header. 249f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao uint32_t expected_size = header_->file_size_; 250f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao if (size_ != expected_size) { 2518d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad file size (%zd, expected %ud)", size_, expected_size); 25210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 25310037c866b04550fc5461058c398c2e3e509381ajeffhao } 25410037c866b04550fc5461058c398c2e3e509381ajeffhao 25510037c866b04550fc5461058c398c2e3e509381ajeffhao // Compute and verify the checksum in the header. 25610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t adler_checksum = adler32(0L, Z_NULL, 0); 25710037c866b04550fc5461058c398c2e3e509381ajeffhao const uint32_t non_sum = sizeof(header_->magic_) + sizeof(header_->checksum_); 25813735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* non_sum_ptr = reinterpret_cast<const uint8_t*>(header_) + non_sum; 259f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao adler_checksum = adler32(adler_checksum, non_sum_ptr, expected_size - non_sum); 26010037c866b04550fc5461058c398c2e3e509381ajeffhao if (adler_checksum != header_->checksum_) { 2618d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad checksum (%08x, expected %08x)", adler_checksum, header_->checksum_); 26210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 26310037c866b04550fc5461058c398c2e3e509381ajeffhao } 26410037c866b04550fc5461058c398c2e3e509381ajeffhao 26510037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the contents of the header. 26610037c866b04550fc5461058c398c2e3e509381ajeffhao if (header_->endian_tag_ != DexFile::kDexEndianConstant) { 2678d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unexpected endian_tag: %x", header_->endian_tag_); 26810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 26910037c866b04550fc5461058c398c2e3e509381ajeffhao } 27010037c866b04550fc5461058c398c2e3e509381ajeffhao 27110037c866b04550fc5461058c398c2e3e509381ajeffhao if (header_->header_size_ != sizeof(DexFile::Header)) { 2728d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad header size: %ud", header_->header_size_); 27310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 27410037c866b04550fc5461058c398c2e3e509381ajeffhao } 27510037c866b04550fc5461058c398c2e3e509381ajeffhao 276d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe // Check that all offsets are inside the file. 277d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe bool result = 278d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->link_off_, header_->link_size_, "link") && 279d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->map_off_, header_->map_off_, "map") && 280d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->string_ids_off_, header_->string_ids_size_, "string-ids") && 281d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->type_ids_off_, header_->type_ids_size_, "type-ids") && 282d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->proto_ids_off_, header_->proto_ids_size_, "proto-ids") && 283d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->field_ids_off_, header_->field_ids_size_, "field-ids") && 284d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->method_ids_off_, header_->method_ids_size_, "method-ids") && 285d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->class_defs_off_, header_->class_defs_size_, "class-defs") && 286d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->data_off_, header_->data_size_, "data"); 287d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 288d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return result; 28910037c866b04550fc5461058c398c2e3e509381ajeffhao} 29010037c866b04550fc5461058c398c2e3e509381ajeffhao 2918d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckMap() { 292d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe const DexFile::MapList* map = reinterpret_cast<const DexFile::MapList*>(begin_ + 293d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe header_->map_off_); 294d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe // Check that map list content is available. 295d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckListSize(map, 1, sizeof(DexFile::MapList), "maplist content")) { 296d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return false; 297d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 298d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 29910037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MapItem* item = map->list_; 30010037c866b04550fc5461058c398c2e3e509381ajeffhao 30110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = map->size_; 30210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_offset = 0; 30310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t data_item_count = 0; 30410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t data_items_left = header_->data_size_; 30510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t used_bits = 0; 30610037c866b04550fc5461058c398c2e3e509381ajeffhao 30710037c866b04550fc5461058c398c2e3e509381ajeffhao // Sanity check the size of the map list. 30810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(item, count, sizeof(DexFile::MapItem), "map size")) { 30910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 31010037c866b04550fc5461058c398c2e3e509381ajeffhao } 31110037c866b04550fc5461058c398c2e3e509381ajeffhao 31210037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the items listed in the map. 31310037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < count; i++) { 3148d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_offset >= item->offset_ && i != 0)) { 3158d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out of order map item: %x then %x", last_offset, item->offset_); 31610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 31710037c866b04550fc5461058c398c2e3e509381ajeffhao } 3188d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(item->offset_ >= header_->file_size_)) { 3198d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map item after end of file: %x, size %x", 3208d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers item->offset_, header_->file_size_); 32110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 32210037c866b04550fc5461058c398c2e3e509381ajeffhao } 32310037c866b04550fc5461058c398c2e3e509381ajeffhao 32410037c866b04550fc5461058c398c2e3e509381ajeffhao if (IsDataSectionType(item->type_)) { 32510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t icount = item->size_; 3268d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(icount > data_items_left)) { 3278d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Too many items in data section: %ud", data_item_count + icount); 32810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 32910037c866b04550fc5461058c398c2e3e509381ajeffhao } 33010037c866b04550fc5461058c398c2e3e509381ajeffhao data_items_left -= icount; 33110037c866b04550fc5461058c398c2e3e509381ajeffhao data_item_count += icount; 33210037c866b04550fc5461058c398c2e3e509381ajeffhao } 33310037c866b04550fc5461058c398c2e3e509381ajeffhao 33410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t bit = MapTypeToBitMask(item->type_); 33510037c866b04550fc5461058c398c2e3e509381ajeffhao 3368d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(bit == 0)) { 3378d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map section type %x", item->type_); 33810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 33910037c866b04550fc5461058c398c2e3e509381ajeffhao } 34010037c866b04550fc5461058c398c2e3e509381ajeffhao 3418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & bit) != 0)) { 3428d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Duplicate map section of type %x", item->type_); 34310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 34410037c866b04550fc5461058c398c2e3e509381ajeffhao } 34510037c866b04550fc5461058c398c2e3e509381ajeffhao 34610037c866b04550fc5461058c398c2e3e509381ajeffhao used_bits |= bit; 34710037c866b04550fc5461058c398c2e3e509381ajeffhao last_offset = item->offset_; 34810037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 34910037c866b04550fc5461058c398c2e3e509381ajeffhao } 35010037c866b04550fc5461058c398c2e3e509381ajeffhao 35110037c866b04550fc5461058c398c2e3e509381ajeffhao // Check for missing sections in the map. 3528d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeHeaderItem)) == 0)) { 3538d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing header entry"); 35410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 35510037c866b04550fc5461058c398c2e3e509381ajeffhao } 3568d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeMapList)) == 0)) { 3578d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing map_list entry"); 35810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 35910037c866b04550fc5461058c398c2e3e509381ajeffhao } 3608d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeStringIdItem)) == 0 && 3618d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->string_ids_off_ != 0) || (header_->string_ids_size_ != 0)))) { 3628d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing string_ids entry"); 36310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 36410037c866b04550fc5461058c398c2e3e509381ajeffhao } 3658d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeTypeIdItem)) == 0 && 3668d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->type_ids_off_ != 0) || (header_->type_ids_size_ != 0)))) { 3678d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing type_ids entry"); 36810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 36910037c866b04550fc5461058c398c2e3e509381ajeffhao } 3708d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeProtoIdItem)) == 0 && 3718d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->proto_ids_off_ != 0) || (header_->proto_ids_size_ != 0)))) { 3728d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing proto_ids entry"); 37310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 37410037c866b04550fc5461058c398c2e3e509381ajeffhao } 3758d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeFieldIdItem)) == 0 && 3768d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->field_ids_off_ != 0) || (header_->field_ids_size_ != 0)))) { 3778d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing field_ids entry"); 37810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 37910037c866b04550fc5461058c398c2e3e509381ajeffhao } 3808d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeMethodIdItem)) == 0 && 3818d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->method_ids_off_ != 0) || (header_->method_ids_size_ != 0)))) { 3828d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing method_ids entry"); 38310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 38410037c866b04550fc5461058c398c2e3e509381ajeffhao } 3858d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeClassDefItem)) == 0 && 3868d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->class_defs_off_ != 0) || (header_->class_defs_size_ != 0)))) { 3878d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing class_defs entry"); 38810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 38910037c866b04550fc5461058c398c2e3e509381ajeffhao } 39010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 39110037c866b04550fc5461058c398c2e3e509381ajeffhao} 39210037c866b04550fc5461058c398c2e3e509381ajeffhao 39310037c866b04550fc5461058c398c2e3e509381ajeffhaouint32_t DexFileVerifier::ReadUnsignedLittleEndian(uint32_t size) { 39410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t result = 0; 39513735955f39b3b304c37d2b2840663c131262c18Ian Rogers if (LIKELY(CheckListSize(ptr_, size, sizeof(uint8_t), "encoded_value"))) { 3968d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers for (uint32_t i = 0; i < size; i++) { 3978d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers result |= ((uint32_t) *(ptr_++)) << (i * 8); 3988d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } 39910037c866b04550fc5461058c398c2e3e509381ajeffhao } 40010037c866b04550fc5461058c398c2e3e509381ajeffhao return result; 40110037c866b04550fc5461058c398c2e3e509381ajeffhao} 40210037c866b04550fc5461058c398c2e3e509381ajeffhao 40310037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckAndGetHandlerOffsets(const DexFile::CodeItem* code_item, 4048d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers uint32_t* handler_offsets, uint32_t handlers_size) { 40513735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* handlers_base = DexFile::GetCatchHandlerData(*code_item, 0); 40610037c866b04550fc5461058c398c2e3e509381ajeffhao 40710037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < handlers_size; i++) { 40810037c866b04550fc5461058c398c2e3e509381ajeffhao bool catch_all; 4098a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t offset = ptr_ - handlers_base; 41010037c866b04550fc5461058c398c2e3e509381ajeffhao int32_t size = DecodeSignedLeb128(&ptr_); 41110037c866b04550fc5461058c398c2e3e509381ajeffhao 4128d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((size < -65536) || (size > 65536))) { 4138d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid exception handler size: %d", size); 41410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 41510037c866b04550fc5461058c398c2e3e509381ajeffhao } 41610037c866b04550fc5461058c398c2e3e509381ajeffhao 41710037c866b04550fc5461058c398c2e3e509381ajeffhao if (size <= 0) { 41810037c866b04550fc5461058c398c2e3e509381ajeffhao catch_all = true; 41910037c866b04550fc5461058c398c2e3e509381ajeffhao size = -size; 42010037c866b04550fc5461058c398c2e3e509381ajeffhao } else { 42110037c866b04550fc5461058c398c2e3e509381ajeffhao catch_all = false; 42210037c866b04550fc5461058c398c2e3e509381ajeffhao } 42310037c866b04550fc5461058c398c2e3e509381ajeffhao 4248a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers handler_offsets[i] = static_cast<uint32_t>(offset); 42510037c866b04550fc5461058c398c2e3e509381ajeffhao 42610037c866b04550fc5461058c398c2e3e509381ajeffhao while (size-- > 0) { 42710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t type_idx = DecodeUnsignedLeb128(&ptr_); 42810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(type_idx, header_->type_ids_size_, "handler type_idx")) { 42910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 43010037c866b04550fc5461058c398c2e3e509381ajeffhao } 43110037c866b04550fc5461058c398c2e3e509381ajeffhao 43210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t addr = DecodeUnsignedLeb128(&ptr_); 4338d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(addr >= code_item->insns_size_in_code_units_)) { 4348d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid handler addr: %x", addr); 43510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 43610037c866b04550fc5461058c398c2e3e509381ajeffhao } 43710037c866b04550fc5461058c398c2e3e509381ajeffhao } 43810037c866b04550fc5461058c398c2e3e509381ajeffhao 43910037c866b04550fc5461058c398c2e3e509381ajeffhao if (catch_all) { 44010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t addr = DecodeUnsignedLeb128(&ptr_); 4418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(addr >= code_item->insns_size_in_code_units_)) { 4428d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid handler catch_all_addr: %x", addr); 44310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 44410037c866b04550fc5461058c398c2e3e509381ajeffhao } 44510037c866b04550fc5461058c398c2e3e509381ajeffhao } 44610037c866b04550fc5461058c398c2e3e509381ajeffhao } 44710037c866b04550fc5461058c398c2e3e509381ajeffhao 44810037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 44910037c866b04550fc5461058c398c2e3e509381ajeffhao} 45010037c866b04550fc5461058c398c2e3e509381ajeffhao 451e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::CheckClassDataItemField(uint32_t idx, 452e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t access_flags, 453e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t class_access_flags, 4541a9735701d0826adbc9d68cd3762b78f96499cfbAndreas Gampe uint16_t class_type_index, 4558d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers bool expect_static) { 456e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check for overflow. 45710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->field_ids_size_, "class_data_item field_idx")) { 45810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 45910037c866b04550fc5461058c398c2e3e509381ajeffhao } 46010037c866b04550fc5461058c398c2e3e509381ajeffhao 461e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check that it's the right class. 462e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint16_t my_class_index = 463e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (reinterpret_cast<const DexFile::FieldId*>(begin_ + header_->field_ids_off_) + idx)-> 464e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_idx_; 465e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (class_type_index != my_class_index) { 466e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ErrorStringPrintf("Field's class index unexpected, %" PRIu16 "vs %" PRIu16, 467e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe my_class_index, 468e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_type_index); 469e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 470e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 471e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 472e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check that it falls into the right class-data list. 47310037c866b04550fc5461058c398c2e3e509381ajeffhao bool is_static = (access_flags & kAccStatic) != 0; 4748d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(is_static != expect_static)) { 4758d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Static/instance field not in expected list"); 47610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 47710037c866b04550fc5461058c398c2e3e509381ajeffhao } 47810037c866b04550fc5461058c398c2e3e509381ajeffhao 479e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check field access flags. 480e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::string error_msg; 481e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckFieldAccessFlags(access_flags, class_access_flags, &error_msg)) { 482e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ErrorStringPrintf("%s", error_msg.c_str()); 48310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 48410037c866b04550fc5461058c398c2e3e509381ajeffhao } 48510037c866b04550fc5461058c398c2e3e509381ajeffhao 48610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 48710037c866b04550fc5461058c398c2e3e509381ajeffhao} 48810037c866b04550fc5461058c398c2e3e509381ajeffhao 489e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::CheckClassDataItemMethod(uint32_t idx, 490e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t access_flags, 491e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t class_access_flags, 4921a9735701d0826adbc9d68cd3762b78f96499cfbAndreas Gampe uint16_t class_type_index, 493a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao uint32_t code_offset, 494e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::unordered_set<uint32_t>* direct_method_indexes, 495a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao bool expect_direct) { 496e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe DCHECK(direct_method_indexes != nullptr); 497e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check for overflow. 49810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->method_ids_size_, "class_data_item method_idx")) { 49910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 50010037c866b04550fc5461058c398c2e3e509381ajeffhao } 50110037c866b04550fc5461058c398c2e3e509381ajeffhao 502e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check that it's the right class. 503e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint16_t my_class_index = 504e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (reinterpret_cast<const DexFile::MethodId*>(begin_ + header_->method_ids_off_) + idx)-> 505e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_idx_; 506e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (class_type_index != my_class_index) { 507e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ErrorStringPrintf("Method's class index unexpected, %" PRIu16 "vs %" PRIu16, 508e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe my_class_index, 509e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_type_index); 51010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 51110037c866b04550fc5461058c398c2e3e509381ajeffhao } 51210037c866b04550fc5461058c398c2e3e509381ajeffhao 513e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check that it's not defined as both direct and virtual. 514a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao if (expect_direct) { 515e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe direct_method_indexes->insert(idx); 516e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } else if (direct_method_indexes->find(idx) != direct_method_indexes->end()) { 517a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao ErrorStringPrintf("Found virtual method with same index as direct method: %d", idx); 518a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao return false; 519a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao } 520a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao 521e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check method access flags. 522e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool has_code = (code_offset != 0); 523e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::string error_msg; 524e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckMethodAccessFlags(idx, 525e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe access_flags, 526e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_access_flags, 527e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe has_code, 528e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe expect_direct, 529e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &error_msg)) { 530e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ErrorStringPrintf("%s", error_msg.c_str()); 53110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 53210037c866b04550fc5461058c398c2e3e509381ajeffhao } 53310037c866b04550fc5461058c398c2e3e509381ajeffhao 53410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 53510037c866b04550fc5461058c398c2e3e509381ajeffhao} 53610037c866b04550fc5461058c398c2e3e509381ajeffhao 5378a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckPadding(size_t offset, uint32_t aligned_offset) { 53810037c866b04550fc5461058c398c2e3e509381ajeffhao if (offset < aligned_offset) { 53913735955f39b3b304c37d2b2840663c131262c18Ian Rogers if (!CheckListSize(begin_ + offset, aligned_offset - offset, sizeof(uint8_t), "section")) { 54010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 54110037c866b04550fc5461058c398c2e3e509381ajeffhao } 54210037c866b04550fc5461058c398c2e3e509381ajeffhao while (offset < aligned_offset) { 5438d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(*ptr_ != '\0')) { 5448a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Non-zero padding %x before section start at %zx", *ptr_, offset); 54510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 54610037c866b04550fc5461058c398c2e3e509381ajeffhao } 54710037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_++; 54810037c866b04550fc5461058c398c2e3e509381ajeffhao offset++; 54910037c866b04550fc5461058c398c2e3e509381ajeffhao } 55010037c866b04550fc5461058c398c2e3e509381ajeffhao } 55110037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 55210037c866b04550fc5461058c398c2e3e509381ajeffhao} 55310037c866b04550fc5461058c398c2e3e509381ajeffhao 55410037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckEncodedValue() { 55513735955f39b3b304c37d2b2840663c131262c18Ian Rogers if (!CheckListSize(ptr_, 1, sizeof(uint8_t), "encoded_value header")) { 55610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 55710037c866b04550fc5461058c398c2e3e509381ajeffhao } 55810037c866b04550fc5461058c398c2e3e509381ajeffhao 55910037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t header_byte = *(ptr_++); 56010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t value_type = header_byte & DexFile::kDexAnnotationValueTypeMask; 56110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t value_arg = header_byte >> DexFile::kDexAnnotationValueArgShift; 56210037c866b04550fc5461058c398c2e3e509381ajeffhao 56310037c866b04550fc5461058c398c2e3e509381ajeffhao switch (value_type) { 56410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationByte: 5658d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 5668d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value byte size %x", value_arg); 56710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 56810037c866b04550fc5461058c398c2e3e509381ajeffhao } 56910037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_++; 57010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 57110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationShort: 57210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationChar: 5738d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 1)) { 5748d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value char/short size %x", value_arg); 57510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 57610037c866b04550fc5461058c398c2e3e509381ajeffhao } 57710037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += value_arg + 1; 57810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 57910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationInt: 58010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationFloat: 5818d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 5828d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value int/float size %x", value_arg); 58310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 58410037c866b04550fc5461058c398c2e3e509381ajeffhao } 58510037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += value_arg + 1; 58610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 58710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationLong: 58810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationDouble: 58910037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += value_arg + 1; 59010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 59110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationString: { 5928d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 5938d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value string size %x", value_arg); 59410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 59510037c866b04550fc5461058c398c2e3e509381ajeffhao } 59610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 59710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->string_ids_size_, "encoded_value string")) { 59810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 59910037c866b04550fc5461058c398c2e3e509381ajeffhao } 60010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 60110037c866b04550fc5461058c398c2e3e509381ajeffhao } 60210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationType: { 6038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 6048d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value type size %x", value_arg); 60510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 60610037c866b04550fc5461058c398c2e3e509381ajeffhao } 60710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 60810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->type_ids_size_, "encoded_value type")) { 60910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 61010037c866b04550fc5461058c398c2e3e509381ajeffhao } 61110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 61210037c866b04550fc5461058c398c2e3e509381ajeffhao } 61310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationField: 61410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationEnum: { 6158d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 6168d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value field/enum size %x", value_arg); 61710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 61810037c866b04550fc5461058c398c2e3e509381ajeffhao } 61910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 62010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->field_ids_size_, "encoded_value field")) { 62110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 62210037c866b04550fc5461058c398c2e3e509381ajeffhao } 62310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 62410037c866b04550fc5461058c398c2e3e509381ajeffhao } 62510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationMethod: { 6268d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 6278d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value method size %x", value_arg); 62810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 62910037c866b04550fc5461058c398c2e3e509381ajeffhao } 63010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 63110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->method_ids_size_, "encoded_value method")) { 63210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 63310037c866b04550fc5461058c398c2e3e509381ajeffhao } 63410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 63510037c866b04550fc5461058c398c2e3e509381ajeffhao } 63610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationArray: 6378d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 6388d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value array value_arg %x", value_arg); 63910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 64010037c866b04550fc5461058c398c2e3e509381ajeffhao } 64110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedArray()) { 64210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 64310037c866b04550fc5461058c398c2e3e509381ajeffhao } 64410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 64510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationAnnotation: 6468d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 6478d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value annotation value_arg %x", value_arg); 64810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 64910037c866b04550fc5461058c398c2e3e509381ajeffhao } 65010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedAnnotation()) { 65110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 65210037c866b04550fc5461058c398c2e3e509381ajeffhao } 65310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 65410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationNull: 6558d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 6568d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value null value_arg %x", value_arg); 65710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 65810037c866b04550fc5461058c398c2e3e509381ajeffhao } 65910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 66010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationBoolean: 6618d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 1)) { 6628d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value boolean size %x", value_arg); 66310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 66410037c866b04550fc5461058c398c2e3e509381ajeffhao } 66510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 66610037c866b04550fc5461058c398c2e3e509381ajeffhao default: 6678d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bogus encoded_value value_type %x", value_type); 66810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 66910037c866b04550fc5461058c398c2e3e509381ajeffhao } 67010037c866b04550fc5461058c398c2e3e509381ajeffhao 67110037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 67210037c866b04550fc5461058c398c2e3e509381ajeffhao} 67310037c866b04550fc5461058c398c2e3e509381ajeffhao 67410037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckEncodedArray() { 67510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = DecodeUnsignedLeb128(&ptr_); 67610037c866b04550fc5461058c398c2e3e509381ajeffhao 67710037c866b04550fc5461058c398c2e3e509381ajeffhao while (size--) { 67810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedValue()) { 6798d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers failure_reason_ = StringPrintf("Bad encoded_array value: %s", failure_reason_.c_str()); 68010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 68110037c866b04550fc5461058c398c2e3e509381ajeffhao } 68210037c866b04550fc5461058c398c2e3e509381ajeffhao } 68310037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 68410037c866b04550fc5461058c398c2e3e509381ajeffhao} 68510037c866b04550fc5461058c398c2e3e509381ajeffhao 68610037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckEncodedAnnotation() { 68710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = DecodeUnsignedLeb128(&ptr_); 68810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->type_ids_size_, "encoded_annotation type_idx")) { 68910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 69010037c866b04550fc5461058c398c2e3e509381ajeffhao } 69110037c866b04550fc5461058c398c2e3e509381ajeffhao 69210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = DecodeUnsignedLeb128(&ptr_); 69310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_idx = 0; 69410037c866b04550fc5461058c398c2e3e509381ajeffhao 69510037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < size; i++) { 69610037c866b04550fc5461058c398c2e3e509381ajeffhao idx = DecodeUnsignedLeb128(&ptr_); 69710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->string_ids_size_, "annotation_element name_idx")) { 69810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 69910037c866b04550fc5461058c398c2e3e509381ajeffhao } 70010037c866b04550fc5461058c398c2e3e509381ajeffhao 7018d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= idx && i != 0)) { 7028d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order annotation_element name_idx: %x then %x", 7038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers last_idx, idx); 70410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 70510037c866b04550fc5461058c398c2e3e509381ajeffhao } 70610037c866b04550fc5461058c398c2e3e509381ajeffhao 70710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedValue()) { 70810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 70910037c866b04550fc5461058c398c2e3e509381ajeffhao } 71010037c866b04550fc5461058c398c2e3e509381ajeffhao 71110037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = idx; 71210037c866b04550fc5461058c398c2e3e509381ajeffhao } 71310037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 71410037c866b04550fc5461058c398c2e3e509381ajeffhao} 71510037c866b04550fc5461058c398c2e3e509381ajeffhao 716e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::FindClassFlags(uint32_t index, 717e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool is_field, 718e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint16_t* class_type_index, 719e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t* class_access_flags) { 720e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe DCHECK(class_type_index != nullptr); 721e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe DCHECK(class_access_flags != nullptr); 72210037c866b04550fc5461058c398c2e3e509381ajeffhao 723e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // First check if the index is valid. 724e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (index >= (is_field ? header_->field_ids_size_ : header_->method_ids_size_)) { 725e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 72610037c866b04550fc5461058c398c2e3e509381ajeffhao } 727e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 728e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Next get the type index. 729e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (is_field) { 730e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *class_type_index = 731e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (reinterpret_cast<const DexFile::FieldId*>(begin_ + header_->field_ids_off_) + index)-> 732e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_idx_; 733e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } else { 734e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *class_type_index = 735e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (reinterpret_cast<const DexFile::MethodId*>(begin_ + header_->method_ids_off_) + index)-> 736e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_idx_; 737e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 738e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 739e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check if that is valid. 740e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (*class_type_index >= header_->type_ids_size_) { 741e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 742e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 743e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 744e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Now search for the class def. This is basically a specialized version of the DexFile code, as 745e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // we should not trust that this is a valid DexFile just yet. 746e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const DexFile::ClassDef* class_def_begin = 747e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe reinterpret_cast<const DexFile::ClassDef*>(begin_ + header_->class_defs_off_); 748e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe for (size_t i = 0; i < header_->class_defs_size_; ++i) { 749e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const DexFile::ClassDef* class_def = class_def_begin + i; 750e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (class_def->class_idx_ == *class_type_index) { 751e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *class_access_flags = class_def->access_flags_; 752e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 753ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao } 754e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 755e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 756e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Didn't find the class-def, not defined here... 757e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 758e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 759e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 760e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::CheckOrderAndGetClassFlags(bool is_field, 761e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const char* type_descr, 762e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t curr_index, 763e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t prev_index, 764e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool* have_class, 765e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint16_t* class_type_index, 766e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t* class_access_flags) { 767e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (curr_index < prev_index) { 768e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ErrorStringPrintf("out-of-order %s indexes %" PRIu32 " and %" PRIu32, 769e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe type_descr, 770e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe prev_index, 771e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe curr_index); 772e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 773e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 774e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 775e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!*have_class) { 776e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *have_class = FindClassFlags(curr_index, is_field, class_type_index, class_access_flags); 777e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!*have_class) { 778e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Should have really found one. 779e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ErrorStringPrintf("could not find declaring class for %s index %" PRIu32, 780e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe type_descr, 781e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe curr_index); 78210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 78310037c866b04550fc5461058c398c2e3e509381ajeffhao } 78410037c866b04550fc5461058c398c2e3e509381ajeffhao } 785e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 786e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 787e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 788e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampetemplate <bool kStatic> 789e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::CheckIntraClassDataItemFields(ClassDataItemIterator* it, 790e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool* have_class, 791e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint16_t* class_type_index, 792e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t* class_access_flags) { 793e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe DCHECK(it != nullptr); 794e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // These calls use the raw access flags to check whether the whole dex field is valid. 795e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t prev_index = 0; 796e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe for (; kStatic ? it->HasNextStaticField() : it->HasNextInstanceField(); it->Next()) { 797e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t curr_index = it->GetMemberIndex(); 798e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckOrderAndGetClassFlags(true, 799e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kStatic ? "static field" : "instance field", 800e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe curr_index, 801e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe prev_index, 802e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe have_class, 803e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_type_index, 804e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_access_flags)) { 805ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao return false; 806ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao } 807ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao prev_index = curr_index; 808e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 809e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckClassDataItemField(curr_index, 810e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe it->GetRawMemberAccessFlags(), 811e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *class_access_flags, 812e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *class_type_index, 813e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kStatic)) { 81410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 81510037c866b04550fc5461058c398c2e3e509381ajeffhao } 81610037c866b04550fc5461058c398c2e3e509381ajeffhao } 817e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 818e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 819e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 820e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 821e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampetemplate <bool kDirect> 822e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::CheckIntraClassDataItemMethods( 823e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ClassDataItemIterator* it, 824e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::unordered_set<uint32_t>* direct_method_indexes, 825e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool* have_class, 826e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint16_t* class_type_index, 827e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t* class_access_flags) { 828e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t prev_index = 0; 829e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe for (; kDirect ? it->HasNextDirectMethod() : it->HasNextVirtualMethod(); it->Next()) { 830e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t curr_index = it->GetMemberIndex(); 831e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckOrderAndGetClassFlags(false, 832e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kDirect ? "direct method" : "virtual method", 833e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe curr_index, 834e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe prev_index, 835e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe have_class, 836e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_type_index, 837e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe class_access_flags)) { 838ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao return false; 839ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao } 840ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao prev_index = curr_index; 841e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 842e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckClassDataItemMethod(curr_index, 843e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe it->GetRawMemberAccessFlags(), 844e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *class_access_flags, 845e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *class_type_index, 846e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe it->GetMethodCodeItemOffset(), 847e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe direct_method_indexes, 848e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kDirect)) { 84910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 85010037c866b04550fc5461058c398c2e3e509381ajeffhao } 85110037c866b04550fc5461058c398c2e3e509381ajeffhao } 85210037c866b04550fc5461058c398c2e3e509381ajeffhao 853e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 854e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 855e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 856e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::CheckIntraClassDataItem() { 857e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe ClassDataItemIterator it(*dex_file_, ptr_); 858e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::unordered_set<uint32_t> direct_method_indexes; 859e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 860e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // This code is complicated by the fact that we don't directly know which class this belongs to. 861e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // So we need to explicitly search with the first item we find (either field or method), and then, 862e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // as the lookup is expensive, cache the result. 863e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool have_class = false; 864e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint16_t class_type_index; 865e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t class_access_flags; 866e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 867e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check fields. 868e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckIntraClassDataItemFields<true>(&it, 869e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &have_class, 870e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_type_index, 871e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_access_flags)) { 872e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 873e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 874e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckIntraClassDataItemFields<false>(&it, 875e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &have_class, 876e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_type_index, 877e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_access_flags)) { 878e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 879e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 880e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 881e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check methods. 882e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckIntraClassDataItemMethods<true>(&it, 883e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &direct_method_indexes, 884e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &have_class, 885e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_type_index, 886e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_access_flags)) { 887e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 888e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 889e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckIntraClassDataItemMethods<false>(&it, 890e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &direct_method_indexes, 891e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &have_class, 892e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_type_index, 893e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe &class_access_flags)) { 894e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 895e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 896e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 89710037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = it.EndDataPointer(); 89810037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 89910037c866b04550fc5461058c398c2e3e509381ajeffhao} 90010037c866b04550fc5461058c398c2e3e509381ajeffhao 90110037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraCodeItem() { 90210037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::CodeItem* code_item = reinterpret_cast<const DexFile::CodeItem*>(ptr_); 90350d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(code_item, 1, sizeof(DexFile::CodeItem), "code")) { 90410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 90510037c866b04550fc5461058c398c2e3e509381ajeffhao } 90610037c866b04550fc5461058c398c2e3e509381ajeffhao 9078d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(code_item->ins_size_ > code_item->registers_size_)) { 9088d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("ins_size (%ud) > registers_size (%ud)", 9098d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers code_item->ins_size_, code_item->registers_size_); 91010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 91110037c866b04550fc5461058c398c2e3e509381ajeffhao } 91210037c866b04550fc5461058c398c2e3e509381ajeffhao 9138d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((code_item->outs_size_ > 5) && 9148d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers (code_item->outs_size_ > code_item->registers_size_))) { 91510037c866b04550fc5461058c398c2e3e509381ajeffhao /* 91610037c866b04550fc5461058c398c2e3e509381ajeffhao * outs_size can be up to 5, even if registers_size is smaller, since the 91710037c866b04550fc5461058c398c2e3e509381ajeffhao * short forms of method invocation allow repetitions of a register multiple 91810037c866b04550fc5461058c398c2e3e509381ajeffhao * times within a single parameter list. However, longer parameter lists 91910037c866b04550fc5461058c398c2e3e509381ajeffhao * need to be represented in-order in the register file. 92010037c866b04550fc5461058c398c2e3e509381ajeffhao */ 9218d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("outs_size (%ud) > registers_size (%ud)", 9228d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers code_item->outs_size_, code_item->registers_size_); 92310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 92410037c866b04550fc5461058c398c2e3e509381ajeffhao } 92510037c866b04550fc5461058c398c2e3e509381ajeffhao 92610037c866b04550fc5461058c398c2e3e509381ajeffhao const uint16_t* insns = code_item->insns_; 92710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t insns_size = code_item->insns_size_in_code_units_; 92810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(insns, insns_size, sizeof(uint16_t), "insns size")) { 92910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 93010037c866b04550fc5461058c398c2e3e509381ajeffhao } 93110037c866b04550fc5461058c398c2e3e509381ajeffhao 93210037c866b04550fc5461058c398c2e3e509381ajeffhao // Grab the end of the insns if there are no try_items. 93310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t try_items_size = code_item->tries_size_; 93410037c866b04550fc5461058c398c2e3e509381ajeffhao if (try_items_size == 0) { 93513735955f39b3b304c37d2b2840663c131262c18Ian Rogers ptr_ = reinterpret_cast<const uint8_t*>(&insns[insns_size]); 93610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 93710037c866b04550fc5461058c398c2e3e509381ajeffhao } 93810037c866b04550fc5461058c398c2e3e509381ajeffhao 93910037c866b04550fc5461058c398c2e3e509381ajeffhao // try_items are 4-byte aligned. Verify the spacer is 0. 9408a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers if (((reinterpret_cast<uintptr_t>(&insns[insns_size]) & 3) != 0) && (insns[insns_size] != 0)) { 9418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Non-zero padding: %x", insns[insns_size]); 94210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 94310037c866b04550fc5461058c398c2e3e509381ajeffhao } 94410037c866b04550fc5461058c398c2e3e509381ajeffhao 94510037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TryItem* try_items = DexFile::GetTryItems(*code_item, 0); 94610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(try_items, try_items_size, sizeof(DexFile::TryItem), "try_items size")) { 94710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 94810037c866b04550fc5461058c398c2e3e509381ajeffhao } 94910037c866b04550fc5461058c398c2e3e509381ajeffhao 9506a8df53d90e47e3256faf7ff0caed0acf377b99bAnestis Bechtsoudis ptr_ = DexFile::GetCatchHandlerData(*code_item, 0); 9516a8df53d90e47e3256faf7ff0caed0acf377b99bAnestis Bechtsoudis uint32_t handlers_size = DecodeUnsignedLeb128(&ptr_); 9526a8df53d90e47e3256faf7ff0caed0acf377b99bAnestis Bechtsoudis 9538d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((handlers_size == 0) || (handlers_size >= 65536))) { 9548d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid handlers_size: %ud", handlers_size); 95510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 95610037c866b04550fc5461058c398c2e3e509381ajeffhao } 95710037c866b04550fc5461058c398c2e3e509381ajeffhao 958700a402244a1a423da4f3ba8032459f4b65fa18fIan Rogers std::unique_ptr<uint32_t[]> handler_offsets(new uint32_t[handlers_size]); 959ee0fa76b2e5d39ad36d1ff144b2d0270df81e606Elliott Hughes if (!CheckAndGetHandlerOffsets(code_item, &handler_offsets[0], handlers_size)) { 96010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 96110037c866b04550fc5461058c398c2e3e509381ajeffhao } 96210037c866b04550fc5461058c398c2e3e509381ajeffhao 96310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_addr = 0; 96410037c866b04550fc5461058c398c2e3e509381ajeffhao while (try_items_size--) { 9658d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(try_items->start_addr_ < last_addr)) { 9668d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of_order try_item with start_addr: %x", try_items->start_addr_); 96710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 96810037c866b04550fc5461058c398c2e3e509381ajeffhao } 96910037c866b04550fc5461058c398c2e3e509381ajeffhao 9708d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(try_items->start_addr_ >= insns_size)) { 9718d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid try_item start_addr: %x", try_items->start_addr_); 97210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 97310037c866b04550fc5461058c398c2e3e509381ajeffhao } 97410037c866b04550fc5461058c398c2e3e509381ajeffhao 97510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t i; 97610037c866b04550fc5461058c398c2e3e509381ajeffhao for (i = 0; i < handlers_size; i++) { 97710037c866b04550fc5461058c398c2e3e509381ajeffhao if (try_items->handler_off_ == handler_offsets[i]) { 97810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 97910037c866b04550fc5461058c398c2e3e509381ajeffhao } 98010037c866b04550fc5461058c398c2e3e509381ajeffhao } 98110037c866b04550fc5461058c398c2e3e509381ajeffhao 9828d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(i == handlers_size)) { 9838d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bogus handler offset: %x", try_items->handler_off_); 98410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 98510037c866b04550fc5461058c398c2e3e509381ajeffhao } 98610037c866b04550fc5461058c398c2e3e509381ajeffhao 98710037c866b04550fc5461058c398c2e3e509381ajeffhao last_addr = try_items->start_addr_ + try_items->insn_count_; 9888d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_addr > insns_size)) { 9898d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid try_item insn_count: %x", try_items->insn_count_); 99010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 99110037c866b04550fc5461058c398c2e3e509381ajeffhao } 99210037c866b04550fc5461058c398c2e3e509381ajeffhao 99310037c866b04550fc5461058c398c2e3e509381ajeffhao try_items++; 99410037c866b04550fc5461058c398c2e3e509381ajeffhao } 99510037c866b04550fc5461058c398c2e3e509381ajeffhao 99610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 99710037c866b04550fc5461058c398c2e3e509381ajeffhao} 99810037c866b04550fc5461058c398c2e3e509381ajeffhao 99910037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraStringDataItem() { 100010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = DecodeUnsignedLeb128(&ptr_); 100113735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* file_end = begin_ + size_; 100210037c866b04550fc5461058c398c2e3e509381ajeffhao 100310037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < size; i++) { 1004c647564845429bd709ed3338c13f15063c2f9fd9Brian Carlstrom CHECK_LT(i, size); // b/15014252 Prevents hitting the impossible case below 10058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(ptr_ >= file_end)) { 10068d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("String data would go beyond end-of-file"); 100710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 100810037c866b04550fc5461058c398c2e3e509381ajeffhao } 100910037c866b04550fc5461058c398c2e3e509381ajeffhao 101010037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte = *(ptr_++); 101110037c866b04550fc5461058c398c2e3e509381ajeffhao 101210037c866b04550fc5461058c398c2e3e509381ajeffhao // Switch on the high 4 bits. 101310037c866b04550fc5461058c398c2e3e509381ajeffhao switch (byte >> 4) { 101410037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x00: 101510037c866b04550fc5461058c398c2e3e509381ajeffhao // Special case of bit pattern 0xxx. 10168d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(byte == 0)) { 1017c647564845429bd709ed3338c13f15063c2f9fd9Brian Carlstrom CHECK_LT(i, size); // b/15014252 Actually hit this impossible case with clang 10188d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("String data shorter than indicated utf16_size %x", size); 101910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 102010037c866b04550fc5461058c398c2e3e509381ajeffhao } 102110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 102210037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x01: 102310037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x02: 102410037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x03: 102510037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x04: 102610037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x05: 102710037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x06: 102810037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x07: 102910037c866b04550fc5461058c398c2e3e509381ajeffhao // No extra checks necessary for bit pattern 0xxx. 103010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 103110037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x08: 103210037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x09: 103310037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0a: 103410037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0b: 103510037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0f: 103610037c866b04550fc5461058c398c2e3e509381ajeffhao // Illegal bit patterns 10xx or 1111. 103710037c866b04550fc5461058c398c2e3e509381ajeffhao // Note: 1111 is valid for normal UTF-8, but not here. 10388d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal start byte %x in string data", byte); 103910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 104010037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0c: 104110037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0d: { 104210037c866b04550fc5461058c398c2e3e509381ajeffhao // Bit pattern 110x has an additional byte. 104310037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte2 = *(ptr_++); 10448d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((byte2 & 0xc0) != 0x80)) { 10458d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal continuation byte %x in string data", byte2); 104610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 104710037c866b04550fc5461058c398c2e3e509381ajeffhao } 104810037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t value = ((byte & 0x1f) << 6) | (byte2 & 0x3f); 10498d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((value != 0) && (value < 0x80))) { 10508d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal representation for value %x in string data", value); 105110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 105210037c866b04550fc5461058c398c2e3e509381ajeffhao } 105310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 105410037c866b04550fc5461058c398c2e3e509381ajeffhao } 105510037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0e: { 105610037c866b04550fc5461058c398c2e3e509381ajeffhao // Bit pattern 1110 has 2 additional bytes. 105710037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte2 = *(ptr_++); 10588d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((byte2 & 0xc0) != 0x80)) { 10598d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal continuation byte %x in string data", byte2); 106010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 106110037c866b04550fc5461058c398c2e3e509381ajeffhao } 106210037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte3 = *(ptr_++); 10638d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((byte3 & 0xc0) != 0x80)) { 10648d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal continuation byte %x in string data", byte3); 106510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 106610037c866b04550fc5461058c398c2e3e509381ajeffhao } 106710037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t value = ((byte & 0x0f) << 12) | ((byte2 & 0x3f) << 6) | (byte3 & 0x3f); 10688d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value < 0x800)) { 10698d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal representation for value %x in string data", value); 107010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 107110037c866b04550fc5461058c398c2e3e509381ajeffhao } 107210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 107310037c866b04550fc5461058c398c2e3e509381ajeffhao } 107410037c866b04550fc5461058c398c2e3e509381ajeffhao } 107510037c866b04550fc5461058c398c2e3e509381ajeffhao } 107610037c866b04550fc5461058c398c2e3e509381ajeffhao 10778d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(*(ptr_++) != '\0')) { 10788d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("String longer than indicated size %x", size); 107910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 108010037c866b04550fc5461058c398c2e3e509381ajeffhao } 108110037c866b04550fc5461058c398c2e3e509381ajeffhao 108210037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 108310037c866b04550fc5461058c398c2e3e509381ajeffhao} 108410037c866b04550fc5461058c398c2e3e509381ajeffhao 108510037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraDebugInfoItem() { 108610037c866b04550fc5461058c398c2e3e509381ajeffhao DecodeUnsignedLeb128(&ptr_); 108710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameters_size = DecodeUnsignedLeb128(&ptr_); 10888d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(parameters_size > 65536)) { 10898d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid parameters_size: %x", parameters_size); 109010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 109110037c866b04550fc5461058c398c2e3e509381ajeffhao } 109210037c866b04550fc5461058c398c2e3e509381ajeffhao 109310037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t j = 0; j < parameters_size; j++) { 109410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameter_name = DecodeUnsignedLeb128(&ptr_); 109510037c866b04550fc5461058c398c2e3e509381ajeffhao if (parameter_name != 0) { 109610037c866b04550fc5461058c398c2e3e509381ajeffhao parameter_name--; 109710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(parameter_name, header_->string_ids_size_, "debug_info_item parameter_name")) { 109810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 109910037c866b04550fc5461058c398c2e3e509381ajeffhao } 110010037c866b04550fc5461058c398c2e3e509381ajeffhao } 110110037c866b04550fc5461058c398c2e3e509381ajeffhao } 110210037c866b04550fc5461058c398c2e3e509381ajeffhao 110310037c866b04550fc5461058c398c2e3e509381ajeffhao while (true) { 110410037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t opcode = *(ptr_++); 110510037c866b04550fc5461058c398c2e3e509381ajeffhao switch (opcode) { 110610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_END_SEQUENCE: { 110710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 110810037c866b04550fc5461058c398c2e3e509381ajeffhao } 110910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_ADVANCE_PC: { 111010037c866b04550fc5461058c398c2e3e509381ajeffhao DecodeUnsignedLeb128(&ptr_); 111110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 111210037c866b04550fc5461058c398c2e3e509381ajeffhao } 111310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_ADVANCE_LINE: { 111410037c866b04550fc5461058c398c2e3e509381ajeffhao DecodeSignedLeb128(&ptr_); 111510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 111610037c866b04550fc5461058c398c2e3e509381ajeffhao } 111710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_START_LOCAL: { 111810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t reg_num = DecodeUnsignedLeb128(&ptr_); 11198d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(reg_num >= 65536)) { 11208d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad reg_num for opcode %x", opcode); 112110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 112210037c866b04550fc5461058c398c2e3e509381ajeffhao } 112310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t name_idx = DecodeUnsignedLeb128(&ptr_); 112410037c866b04550fc5461058c398c2e3e509381ajeffhao if (name_idx != 0) { 112510037c866b04550fc5461058c398c2e3e509381ajeffhao name_idx--; 112610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(name_idx, header_->string_ids_size_, "DBG_START_LOCAL name_idx")) { 112710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 112810037c866b04550fc5461058c398c2e3e509381ajeffhao } 112910037c866b04550fc5461058c398c2e3e509381ajeffhao } 113010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t type_idx = DecodeUnsignedLeb128(&ptr_); 113110037c866b04550fc5461058c398c2e3e509381ajeffhao if (type_idx != 0) { 113210037c866b04550fc5461058c398c2e3e509381ajeffhao type_idx--; 1133dd3208d3b2f4b78678a341f38a5cc7761c7fca91Logan Chien if (!CheckIndex(type_idx, header_->type_ids_size_, "DBG_START_LOCAL type_idx")) { 113410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 113510037c866b04550fc5461058c398c2e3e509381ajeffhao } 113610037c866b04550fc5461058c398c2e3e509381ajeffhao } 113710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 113810037c866b04550fc5461058c398c2e3e509381ajeffhao } 113910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_END_LOCAL: 114010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_RESTART_LOCAL: { 114110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t reg_num = DecodeUnsignedLeb128(&ptr_); 11428d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(reg_num >= 65536)) { 11438d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad reg_num for opcode %x", opcode); 114410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 114510037c866b04550fc5461058c398c2e3e509381ajeffhao } 114610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 114710037c866b04550fc5461058c398c2e3e509381ajeffhao } 114810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_START_LOCAL_EXTENDED: { 114910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t reg_num = DecodeUnsignedLeb128(&ptr_); 11508d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(reg_num >= 65536)) { 11518d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad reg_num for opcode %x", opcode); 115210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 115310037c866b04550fc5461058c398c2e3e509381ajeffhao } 115410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t name_idx = DecodeUnsignedLeb128(&ptr_); 115510037c866b04550fc5461058c398c2e3e509381ajeffhao if (name_idx != 0) { 115610037c866b04550fc5461058c398c2e3e509381ajeffhao name_idx--; 115710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(name_idx, header_->string_ids_size_, "DBG_START_LOCAL_EXTENDED name_idx")) { 115810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 115910037c866b04550fc5461058c398c2e3e509381ajeffhao } 116010037c866b04550fc5461058c398c2e3e509381ajeffhao } 116110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t type_idx = DecodeUnsignedLeb128(&ptr_); 116210037c866b04550fc5461058c398c2e3e509381ajeffhao if (type_idx != 0) { 116310037c866b04550fc5461058c398c2e3e509381ajeffhao type_idx--; 1164dd3208d3b2f4b78678a341f38a5cc7761c7fca91Logan Chien if (!CheckIndex(type_idx, header_->type_ids_size_, "DBG_START_LOCAL_EXTENDED type_idx")) { 116510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 116610037c866b04550fc5461058c398c2e3e509381ajeffhao } 116710037c866b04550fc5461058c398c2e3e509381ajeffhao } 116810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t sig_idx = DecodeUnsignedLeb128(&ptr_); 116910037c866b04550fc5461058c398c2e3e509381ajeffhao if (sig_idx != 0) { 117010037c866b04550fc5461058c398c2e3e509381ajeffhao sig_idx--; 117110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(sig_idx, header_->string_ids_size_, "DBG_START_LOCAL_EXTENDED sig_idx")) { 117210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 117310037c866b04550fc5461058c398c2e3e509381ajeffhao } 117410037c866b04550fc5461058c398c2e3e509381ajeffhao } 117510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 117610037c866b04550fc5461058c398c2e3e509381ajeffhao } 117710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_SET_FILE: { 117810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t name_idx = DecodeUnsignedLeb128(&ptr_); 117910037c866b04550fc5461058c398c2e3e509381ajeffhao if (name_idx != 0) { 118010037c866b04550fc5461058c398c2e3e509381ajeffhao name_idx--; 118110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(name_idx, header_->string_ids_size_, "DBG_SET_FILE name_idx")) { 118210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 118310037c866b04550fc5461058c398c2e3e509381ajeffhao } 118410037c866b04550fc5461058c398c2e3e509381ajeffhao } 118510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 118610037c866b04550fc5461058c398c2e3e509381ajeffhao } 118710037c866b04550fc5461058c398c2e3e509381ajeffhao } 118810037c866b04550fc5461058c398c2e3e509381ajeffhao } 118910037c866b04550fc5461058c398c2e3e509381ajeffhao} 119010037c866b04550fc5461058c398c2e3e509381ajeffhao 119110037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraAnnotationItem() { 119213735955f39b3b304c37d2b2840663c131262c18Ian Rogers if (!CheckListSize(ptr_, 1, sizeof(uint8_t), "annotation visibility")) { 119310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 119410037c866b04550fc5461058c398c2e3e509381ajeffhao } 119510037c866b04550fc5461058c398c2e3e509381ajeffhao 119610037c866b04550fc5461058c398c2e3e509381ajeffhao // Check visibility 119710037c866b04550fc5461058c398c2e3e509381ajeffhao switch (*(ptr_++)) { 119810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexVisibilityBuild: 119910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexVisibilityRuntime: 120010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexVisibilitySystem: 120110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 120210037c866b04550fc5461058c398c2e3e509381ajeffhao default: 12038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad annotation visibility: %x", *ptr_); 120410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 120510037c866b04550fc5461058c398c2e3e509381ajeffhao } 120610037c866b04550fc5461058c398c2e3e509381ajeffhao 120710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedAnnotation()) { 120810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 120910037c866b04550fc5461058c398c2e3e509381ajeffhao } 121010037c866b04550fc5461058c398c2e3e509381ajeffhao 121110037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 121210037c866b04550fc5461058c398c2e3e509381ajeffhao} 121310037c866b04550fc5461058c398c2e3e509381ajeffhao 121410037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraAnnotationsDirectoryItem() { 121510037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationsDirectoryItem* item = 121610037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationsDirectoryItem*>(ptr_); 121750d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(item, 1, sizeof(DexFile::AnnotationsDirectoryItem), "annotations_directory")) { 121810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 121910037c866b04550fc5461058c398c2e3e509381ajeffhao } 122010037c866b04550fc5461058c398c2e3e509381ajeffhao 122110037c866b04550fc5461058c398c2e3e509381ajeffhao // Field annotations follow immediately after the annotations directory. 122210037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldAnnotationsItem* field_item = 122310037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::FieldAnnotationsItem*>(item + 1); 122410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t field_count = item->fields_size_; 122510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(field_item, field_count, sizeof(DexFile::FieldAnnotationsItem), "field_annotations list")) { 122610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 122710037c866b04550fc5461058c398c2e3e509381ajeffhao } 122810037c866b04550fc5461058c398c2e3e509381ajeffhao 122910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_idx = 0; 123010037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < field_count; i++) { 12318d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= field_item->field_idx_ && i != 0)) { 12328d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_idx for annotation: %x then %x", last_idx, field_item->field_idx_); 123310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 123410037c866b04550fc5461058c398c2e3e509381ajeffhao } 123510037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = field_item->field_idx_; 123610037c866b04550fc5461058c398c2e3e509381ajeffhao field_item++; 123710037c866b04550fc5461058c398c2e3e509381ajeffhao } 123810037c866b04550fc5461058c398c2e3e509381ajeffhao 123910037c866b04550fc5461058c398c2e3e509381ajeffhao // Method annotations follow immediately after field annotations. 124010037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodAnnotationsItem* method_item = 124110037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::MethodAnnotationsItem*>(field_item); 124210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t method_count = item->methods_size_; 124310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(method_item, method_count, sizeof(DexFile::MethodAnnotationsItem), "method_annotations list")) { 124410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 124510037c866b04550fc5461058c398c2e3e509381ajeffhao } 124610037c866b04550fc5461058c398c2e3e509381ajeffhao 124710037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = 0; 124810037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < method_count; i++) { 12498d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= method_item->method_idx_ && i != 0)) { 12508d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_idx for annotation: %x then %x", 12518d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers last_idx, method_item->method_idx_); 125210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 125310037c866b04550fc5461058c398c2e3e509381ajeffhao } 125410037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = method_item->method_idx_; 125510037c866b04550fc5461058c398c2e3e509381ajeffhao method_item++; 125610037c866b04550fc5461058c398c2e3e509381ajeffhao } 125710037c866b04550fc5461058c398c2e3e509381ajeffhao 125810037c866b04550fc5461058c398c2e3e509381ajeffhao // Parameter annotations follow immediately after method annotations. 125910037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ParameterAnnotationsItem* parameter_item = 126010037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::ParameterAnnotationsItem*>(method_item); 126110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameter_count = item->parameters_size_; 12622b87ddf36abff711fa2233c49bffc7ceb03b15d7Dragos Sbirlea if (!CheckListSize(parameter_item, parameter_count, sizeof(DexFile::ParameterAnnotationsItem), 12638d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers "parameter_annotations list")) { 126410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 126510037c866b04550fc5461058c398c2e3e509381ajeffhao } 126610037c866b04550fc5461058c398c2e3e509381ajeffhao 126710037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = 0; 126810037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < parameter_count; i++) { 12698d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= parameter_item->method_idx_ && i != 0)) { 12708d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_idx for annotation: %x then %x", 12718d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers last_idx, parameter_item->method_idx_); 127210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 127310037c866b04550fc5461058c398c2e3e509381ajeffhao } 127410037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = parameter_item->method_idx_; 127510037c866b04550fc5461058c398c2e3e509381ajeffhao parameter_item++; 127610037c866b04550fc5461058c398c2e3e509381ajeffhao } 127710037c866b04550fc5461058c398c2e3e509381ajeffhao 127810037c866b04550fc5461058c398c2e3e509381ajeffhao // Return a pointer to the end of the annotations. 127913735955f39b3b304c37d2b2840663c131262c18Ian Rogers ptr_ = reinterpret_cast<const uint8_t*>(parameter_item); 128010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 128110037c866b04550fc5461058c398c2e3e509381ajeffhao} 128210037c866b04550fc5461058c398c2e3e509381ajeffhao 1283b061cc1dc41a976f5a620c19498d4b2f4d1675dbAndreas Gampebool DexFileVerifier::CheckIntraSectionIterate(size_t offset, uint32_t section_count, 1284b061cc1dc41a976f5a620c19498d4b2f4d1675dbAndreas Gampe uint16_t type) { 128510037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the right alignment mask for the type of section. 12868a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t alignment_mask; 128710037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 128810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 128910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: 129010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: 129110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: 129210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: 129310037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint8_t) - 1; 129410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 129510037c866b04550fc5461058c398c2e3e509381ajeffhao default: 129610037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint32_t) - 1; 129710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 129810037c866b04550fc5461058c398c2e3e509381ajeffhao } 129910037c866b04550fc5461058c398c2e3e509381ajeffhao 130010037c866b04550fc5461058c398c2e3e509381ajeffhao // Iterate through the items in the section. 1301b061cc1dc41a976f5a620c19498d4b2f4d1675dbAndreas Gampe for (uint32_t i = 0; i < section_count; i++) { 13028a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t aligned_offset = (offset + alignment_mask) & ~alignment_mask; 130310037c866b04550fc5461058c398c2e3e509381ajeffhao 130410037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the padding between items. 130510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPadding(offset, aligned_offset)) { 130610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 130710037c866b04550fc5461058c398c2e3e509381ajeffhao } 130810037c866b04550fc5461058c398c2e3e509381ajeffhao 130910037c866b04550fc5461058c398c2e3e509381ajeffhao // Check depending on the section type. 131010037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 131110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: { 131250d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::StringId), "string_ids")) { 131310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 131410037c866b04550fc5461058c398c2e3e509381ajeffhao } 131510037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::StringId); 131610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 131710037c866b04550fc5461058c398c2e3e509381ajeffhao } 131810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: { 131950d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::TypeId), "type_ids")) { 132010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 132110037c866b04550fc5461058c398c2e3e509381ajeffhao } 132210037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::TypeId); 132310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 132410037c866b04550fc5461058c398c2e3e509381ajeffhao } 132510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: { 132650d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::ProtoId), "proto_ids")) { 132710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 132810037c866b04550fc5461058c398c2e3e509381ajeffhao } 132910037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ProtoId); 133010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 133110037c866b04550fc5461058c398c2e3e509381ajeffhao } 133210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: { 133350d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::FieldId), "field_ids")) { 133410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 133510037c866b04550fc5461058c398c2e3e509381ajeffhao } 133610037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::FieldId); 133710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 133810037c866b04550fc5461058c398c2e3e509381ajeffhao } 133910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: { 134050d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::MethodId), "method_ids")) { 134110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 134210037c866b04550fc5461058c398c2e3e509381ajeffhao } 134310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::MethodId); 134410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 134510037c866b04550fc5461058c398c2e3e509381ajeffhao } 134610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: { 134750d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::ClassDef), "class_defs")) { 134810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 134910037c866b04550fc5461058c398c2e3e509381ajeffhao } 135010037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ClassDef); 135110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 135210037c866b04550fc5461058c398c2e3e509381ajeffhao } 135310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: { 1354d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckList(sizeof(DexFile::TypeItem), "type_list", &ptr_)) { 135510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 135610037c866b04550fc5461058c398c2e3e509381ajeffhao } 135710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 135810037c866b04550fc5461058c398c2e3e509381ajeffhao } 135910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: { 1360d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckList(sizeof(DexFile::AnnotationSetRefItem), "annotation_set_ref_list", &ptr_)) { 136110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 136210037c866b04550fc5461058c398c2e3e509381ajeffhao } 136310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 136410037c866b04550fc5461058c398c2e3e509381ajeffhao } 136510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: { 1366d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckList(sizeof(uint32_t), "annotation_set_item", &ptr_)) { 136710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 136810037c866b04550fc5461058c398c2e3e509381ajeffhao } 136910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 137010037c866b04550fc5461058c398c2e3e509381ajeffhao } 137110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: { 137210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraClassDataItem()) { 137310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 137410037c866b04550fc5461058c398c2e3e509381ajeffhao } 137510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 137610037c866b04550fc5461058c398c2e3e509381ajeffhao } 137710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: { 137810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraCodeItem()) { 137910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 138010037c866b04550fc5461058c398c2e3e509381ajeffhao } 138110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 138210037c866b04550fc5461058c398c2e3e509381ajeffhao } 138310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: { 138410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraStringDataItem()) { 138510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 138610037c866b04550fc5461058c398c2e3e509381ajeffhao } 138710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 138810037c866b04550fc5461058c398c2e3e509381ajeffhao } 138910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: { 139010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraDebugInfoItem()) { 139110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 139210037c866b04550fc5461058c398c2e3e509381ajeffhao } 139310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 139410037c866b04550fc5461058c398c2e3e509381ajeffhao } 139510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: { 139610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraAnnotationItem()) { 139710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 139810037c866b04550fc5461058c398c2e3e509381ajeffhao } 139910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 140010037c866b04550fc5461058c398c2e3e509381ajeffhao } 140110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: { 140210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedArray()) { 140310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 140410037c866b04550fc5461058c398c2e3e509381ajeffhao } 140510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 140610037c866b04550fc5461058c398c2e3e509381ajeffhao } 140710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: { 140810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraAnnotationsDirectoryItem()) { 140910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 141010037c866b04550fc5461058c398c2e3e509381ajeffhao } 141110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 141210037c866b04550fc5461058c398c2e3e509381ajeffhao } 141310037c866b04550fc5461058c398c2e3e509381ajeffhao default: 14148d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 141510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 141610037c866b04550fc5461058c398c2e3e509381ajeffhao } 141710037c866b04550fc5461058c398c2e3e509381ajeffhao 141810037c866b04550fc5461058c398c2e3e509381ajeffhao if (IsDataSectionType(type)) { 14190f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier if (aligned_offset == 0u) { 14200f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier ErrorStringPrintf("Item %d offset is 0", i); 14210f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier return false; 14220f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier } 14230f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier DCHECK(offset_to_type_map_.Find(aligned_offset) == offset_to_type_map_.end()); 14240f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier offset_to_type_map_.Insert(std::pair<uint32_t, uint16_t>(aligned_offset, type)); 142510037c866b04550fc5461058c398c2e3e509381ajeffhao } 142610037c866b04550fc5461058c398c2e3e509381ajeffhao 14278a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers aligned_offset = ptr_ - begin_; 14288d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(aligned_offset > size_)) { 14298d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Item %d at ends out of bounds", i); 143010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 143110037c866b04550fc5461058c398c2e3e509381ajeffhao } 143210037c866b04550fc5461058c398c2e3e509381ajeffhao 143310037c866b04550fc5461058c398c2e3e509381ajeffhao offset = aligned_offset; 143410037c866b04550fc5461058c398c2e3e509381ajeffhao } 143510037c866b04550fc5461058c398c2e3e509381ajeffhao 143610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 143710037c866b04550fc5461058c398c2e3e509381ajeffhao} 143810037c866b04550fc5461058c398c2e3e509381ajeffhao 14398a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckIntraIdSection(size_t offset, uint32_t count, uint16_t type) { 144010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t expected_offset; 144110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t expected_size; 144210037c866b04550fc5461058c398c2e3e509381ajeffhao 144310037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the expected offset and size from the header. 144410037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 144510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 144610037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->string_ids_off_; 144710037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->string_ids_size_; 144810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 144910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 145010037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->type_ids_off_; 145110037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->type_ids_size_; 145210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 145310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 145410037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->proto_ids_off_; 145510037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->proto_ids_size_; 145610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 145710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 145810037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->field_ids_off_; 145910037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->field_ids_size_; 146010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 146110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 146210037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->method_ids_off_; 146310037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->method_ids_size_; 146410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 146510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 146610037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->class_defs_off_; 146710037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->class_defs_size_; 146810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 146910037c866b04550fc5461058c398c2e3e509381ajeffhao default: 14708d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad type for id section: %x", type); 147110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 147210037c866b04550fc5461058c398c2e3e509381ajeffhao } 147310037c866b04550fc5461058c398c2e3e509381ajeffhao 147410037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the offset and size are what were expected from the header. 14758d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(offset != expected_offset)) { 14768a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Bad offset for section: got %zx, expected %x", offset, expected_offset); 147710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 147810037c866b04550fc5461058c398c2e3e509381ajeffhao } 14798d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(count != expected_size)) { 14808d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad size for section: got %x, expected %x", count, expected_size); 148110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 148210037c866b04550fc5461058c398c2e3e509381ajeffhao } 148310037c866b04550fc5461058c398c2e3e509381ajeffhao 148410037c866b04550fc5461058c398c2e3e509381ajeffhao return CheckIntraSectionIterate(offset, count, type); 148510037c866b04550fc5461058c398c2e3e509381ajeffhao} 148610037c866b04550fc5461058c398c2e3e509381ajeffhao 14878a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckIntraDataSection(size_t offset, uint32_t count, uint16_t type) { 14888a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t data_start = header_->data_off_; 14898a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t data_end = data_start + header_->data_size_; 149010037c866b04550fc5461058c398c2e3e509381ajeffhao 149110037c866b04550fc5461058c398c2e3e509381ajeffhao // Sanity check the offset of the section. 14928d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((offset < data_start) || (offset > data_end))) { 14938a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Bad offset for data subsection: %zx", offset); 149410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 149510037c866b04550fc5461058c398c2e3e509381ajeffhao } 149610037c866b04550fc5461058c398c2e3e509381ajeffhao 149710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraSectionIterate(offset, count, type)) { 149810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 149910037c866b04550fc5461058c398c2e3e509381ajeffhao } 150010037c866b04550fc5461058c398c2e3e509381ajeffhao 15018a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t next_offset = ptr_ - begin_; 150210037c866b04550fc5461058c398c2e3e509381ajeffhao if (next_offset > data_end) { 15038a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Out-of-bounds end of data subsection: %zx", next_offset); 150410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 150510037c866b04550fc5461058c398c2e3e509381ajeffhao } 150610037c866b04550fc5461058c398c2e3e509381ajeffhao 150710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 150810037c866b04550fc5461058c398c2e3e509381ajeffhao} 150910037c866b04550fc5461058c398c2e3e509381ajeffhao 151010037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraSection() { 151130fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers const DexFile::MapList* map = reinterpret_cast<const DexFile::MapList*>(begin_ + header_->map_off_); 151210037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MapItem* item = map->list_; 151310037c866b04550fc5461058c398c2e3e509381ajeffhao 151410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = map->size_; 15158a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t offset = 0; 151630fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers ptr_ = begin_; 151710037c866b04550fc5461058c398c2e3e509381ajeffhao 151810037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the items listed in the map. 151910037c866b04550fc5461058c398c2e3e509381ajeffhao while (count--) { 152010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_offset = item->offset_; 152110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_count = item->size_; 152210037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t type = item->type_; 152310037c866b04550fc5461058c398c2e3e509381ajeffhao 152410037c866b04550fc5461058c398c2e3e509381ajeffhao // Check for padding and overlap between items. 152510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPadding(offset, section_offset)) { 152610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 15278d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } else if (UNLIKELY(offset > section_offset)) { 15288a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Section overlap or out-of-order map: %zx, %x", offset, section_offset); 152910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 153010037c866b04550fc5461058c398c2e3e509381ajeffhao } 153110037c866b04550fc5461058c398c2e3e509381ajeffhao 153210037c866b04550fc5461058c398c2e3e509381ajeffhao // Check each item based on its type. 153310037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 153410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: 15358d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_count != 1)) { 15368d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Multiple header items"); 153710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 153810037c866b04550fc5461058c398c2e3e509381ajeffhao } 15398d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_offset != 0)) { 15408d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Header at %x, not at start of file", section_offset); 154110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 154210037c866b04550fc5461058c398c2e3e509381ajeffhao } 154330fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers ptr_ = begin_ + header_->header_size_; 154410037c866b04550fc5461058c398c2e3e509381ajeffhao offset = header_->header_size_; 154510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 154610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 154710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 154810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 154910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 155010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 155110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 155210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraIdSection(section_offset, section_count, type)) { 155310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 155410037c866b04550fc5461058c398c2e3e509381ajeffhao } 15558a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers offset = ptr_ - begin_; 155610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 155710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMapList: 15588d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_count != 1)) { 15598d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Multiple map list items"); 156010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 156110037c866b04550fc5461058c398c2e3e509381ajeffhao } 15628d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_offset != header_->map_off_)) { 15638d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map not at header-defined offset: %x, expected %x", 15648d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers section_offset, header_->map_off_); 156510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 156610037c866b04550fc5461058c398c2e3e509381ajeffhao } 156710037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(uint32_t) + (map->size_ * sizeof(DexFile::MapItem)); 156810037c866b04550fc5461058c398c2e3e509381ajeffhao offset = section_offset + sizeof(uint32_t) + (map->size_ * sizeof(DexFile::MapItem)); 156910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 157010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: 157110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: 157210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: 157310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 157410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: 157510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: 157610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: 157710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: 157810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: 157910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: 158010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraDataSection(section_offset, section_count, type)) { 158110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 158210037c866b04550fc5461058c398c2e3e509381ajeffhao } 15838a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers offset = ptr_ - begin_; 158410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 158510037c866b04550fc5461058c398c2e3e509381ajeffhao default: 15868d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 158710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 158810037c866b04550fc5461058c398c2e3e509381ajeffhao } 158910037c866b04550fc5461058c398c2e3e509381ajeffhao 159010037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 159110037c866b04550fc5461058c398c2e3e509381ajeffhao } 159210037c866b04550fc5461058c398c2e3e509381ajeffhao 159310037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 159410037c866b04550fc5461058c398c2e3e509381ajeffhao} 159510037c866b04550fc5461058c398c2e3e509381ajeffhao 15968a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckOffsetToTypeMap(size_t offset, uint16_t type) { 15970f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier DCHECK_NE(offset, 0u); 15980f8e0723d67bd75125705b2707c36927beabd886Mathieu Chartier auto it = offset_to_type_map_.Find(offset); 15998d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(it == offset_to_type_map_.end())) { 16008a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("No data map entry found @ %zx; expected %x", offset, type); 160110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 160210037c866b04550fc5461058c398c2e3e509381ajeffhao } 16038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(it->second != type)) { 16048a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Unexpected data map entry @ %zx; expected %x, found %x", 16058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers offset, type, it->second); 160610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 160710037c866b04550fc5461058c398c2e3e509381ajeffhao } 160810037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 160910037c866b04550fc5461058c398c2e3e509381ajeffhao} 161010037c866b04550fc5461058c398c2e3e509381ajeffhao 161113735955f39b3b304c37d2b2840663c131262c18Ian Rogersuint16_t DexFileVerifier::FindFirstClassDataDefiner(const uint8_t* ptr, bool* success) { 161210037c866b04550fc5461058c398c2e3e509381ajeffhao ClassDataItemIterator it(*dex_file_, ptr); 16135e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = true; 161410037c866b04550fc5461058c398c2e3e509381ajeffhao 161510037c866b04550fc5461058c398c2e3e509381ajeffhao if (it.HasNextStaticField() || it.HasNextInstanceField()) { 16165e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_FIELD(field, it.GetMemberIndex(), "first_class_data_definer field_id", 16175e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = false; return DexFile::kDexNoIndex16) 1618e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return field->class_idx_; 161910037c866b04550fc5461058c398c2e3e509381ajeffhao } 162010037c866b04550fc5461058c398c2e3e509381ajeffhao 162110037c866b04550fc5461058c398c2e3e509381ajeffhao if (it.HasNextDirectMethod() || it.HasNextVirtualMethod()) { 16225e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_METHOD(method, it.GetMemberIndex(), "first_class_data_definer method_id", 16235e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = false; return DexFile::kDexNoIndex16) 1624e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return method->class_idx_; 162510037c866b04550fc5461058c398c2e3e509381ajeffhao } 162610037c866b04550fc5461058c398c2e3e509381ajeffhao 162710037c866b04550fc5461058c398c2e3e509381ajeffhao return DexFile::kDexNoIndex16; 162810037c866b04550fc5461058c398c2e3e509381ajeffhao} 162910037c866b04550fc5461058c398c2e3e509381ajeffhao 163013735955f39b3b304c37d2b2840663c131262c18Ian Rogersuint16_t DexFileVerifier::FindFirstAnnotationsDirectoryDefiner(const uint8_t* ptr, bool* success) { 163110037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationsDirectoryItem* item = 163210037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationsDirectoryItem*>(ptr); 16335e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = true; 16345e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe 163510037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->fields_size_ != 0) { 163610037c866b04550fc5461058c398c2e3e509381ajeffhao DexFile::FieldAnnotationsItem* field_items = (DexFile::FieldAnnotationsItem*) (item + 1); 16375e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_FIELD(field, field_items[0].field_idx_, "first_annotations_dir_definer field_id", 16385e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = false; return DexFile::kDexNoIndex16) 1639e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return field->class_idx_; 164010037c866b04550fc5461058c398c2e3e509381ajeffhao } 164110037c866b04550fc5461058c398c2e3e509381ajeffhao 164210037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->methods_size_ != 0) { 164310037c866b04550fc5461058c398c2e3e509381ajeffhao DexFile::MethodAnnotationsItem* method_items = (DexFile::MethodAnnotationsItem*) (item + 1); 1644e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_METHOD(method, method_items[0].method_idx_, "first_annotations_dir_definer method id", 16455e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = false; return DexFile::kDexNoIndex16) 1646e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return method->class_idx_; 164710037c866b04550fc5461058c398c2e3e509381ajeffhao } 164810037c866b04550fc5461058c398c2e3e509381ajeffhao 164910037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->parameters_size_ != 0) { 165010037c866b04550fc5461058c398c2e3e509381ajeffhao DexFile::ParameterAnnotationsItem* parameter_items = (DexFile::ParameterAnnotationsItem*) (item + 1); 1651e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_METHOD(method, parameter_items[0].method_idx_, "first_annotations_dir_definer method id", 16525e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = false; return DexFile::kDexNoIndex16) 1653e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return method->class_idx_; 165410037c866b04550fc5461058c398c2e3e509381ajeffhao } 165510037c866b04550fc5461058c398c2e3e509381ajeffhao 165610037c866b04550fc5461058c398c2e3e509381ajeffhao return DexFile::kDexNoIndex16; 165710037c866b04550fc5461058c398c2e3e509381ajeffhao} 165810037c866b04550fc5461058c398c2e3e509381ajeffhao 165910037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterStringIdItem() { 166010037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::StringId* item = reinterpret_cast<const DexFile::StringId*>(ptr_); 166110037c866b04550fc5461058c398c2e3e509381ajeffhao 166210037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the map to make sure it has the right offset->type. 166310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckOffsetToTypeMap(item->string_data_off_, DexFile::kDexTypeStringDataItem)) { 166410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 166510037c866b04550fc5461058c398c2e3e509381ajeffhao } 166610037c866b04550fc5461058c398c2e3e509381ajeffhao 166710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. 16682cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (previous_item_ != nullptr) { 166910037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::StringId* prev_item = reinterpret_cast<const DexFile::StringId*>(previous_item_); 167010037c866b04550fc5461058c398c2e3e509381ajeffhao const char* prev_str = dex_file_->GetStringData(*prev_item); 167110037c866b04550fc5461058c398c2e3e509381ajeffhao const char* str = dex_file_->GetStringData(*item); 16728d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(CompareModifiedUtf8ToModifiedUtf8AsUtf16CodePointValues(prev_str, str) >= 0)) { 16738d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order string_ids: '%s' then '%s'", prev_str, str); 167410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 167510037c866b04550fc5461058c398c2e3e509381ajeffhao } 167610037c866b04550fc5461058c398c2e3e509381ajeffhao } 167710037c866b04550fc5461058c398c2e3e509381ajeffhao 167810037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::StringId); 167910037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 168010037c866b04550fc5461058c398c2e3e509381ajeffhao} 168110037c866b04550fc5461058c398c2e3e509381ajeffhao 168210037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterTypeIdItem() { 168310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TypeId* item = reinterpret_cast<const DexFile::TypeId*>(ptr_); 1684e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 1685e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING(descriptor, item->descriptor_idx_, "inter_type_id_item descriptor_idx") 168610037c866b04550fc5461058c398c2e3e509381ajeffhao 168710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the descriptor is a valid type. 16888d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidDescriptor(descriptor))) { 16898d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid type descriptor: '%s'", descriptor); 169010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 169110037c866b04550fc5461058c398c2e3e509381ajeffhao } 169210037c866b04550fc5461058c398c2e3e509381ajeffhao 169310037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. 16942cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (previous_item_ != nullptr) { 169510037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TypeId* prev_item = reinterpret_cast<const DexFile::TypeId*>(previous_item_); 16968d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->descriptor_idx_ >= item->descriptor_idx_)) { 16978d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order type_ids: %x then %x", 16988d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers prev_item->descriptor_idx_, item->descriptor_idx_); 169910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 170010037c866b04550fc5461058c398c2e3e509381ajeffhao } 170110037c866b04550fc5461058c398c2e3e509381ajeffhao } 170210037c866b04550fc5461058c398c2e3e509381ajeffhao 170310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::TypeId); 170410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 170510037c866b04550fc5461058c398c2e3e509381ajeffhao} 170610037c866b04550fc5461058c398c2e3e509381ajeffhao 170710037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterProtoIdItem() { 170810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ProtoId* item = reinterpret_cast<const DexFile::ProtoId*>(ptr_); 1709e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 1710e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING(shorty, item->shorty_idx_, "inter_proto_id_item shorty_idx") 1711e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 171210037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->parameters_off_ != 0 && 171310037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->parameters_off_, DexFile::kDexTypeTypeList)) { 171410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 171510037c866b04550fc5461058c398c2e3e509381ajeffhao } 171610037c866b04550fc5461058c398c2e3e509381ajeffhao 171710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the return type and advance the shorty. 1718e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(return_type, item->return_type_idx_, "inter_proto_id_item return_type_idx") 1719e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (!CheckShortyDescriptorMatch(*shorty, return_type, true)) { 172010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 172110037c866b04550fc5461058c398c2e3e509381ajeffhao } 172210037c866b04550fc5461058c398c2e3e509381ajeffhao shorty++; 172310037c866b04550fc5461058c398c2e3e509381ajeffhao 172410037c866b04550fc5461058c398c2e3e509381ajeffhao DexFileParameterIterator it(*dex_file_, *item); 172510037c866b04550fc5461058c398c2e3e509381ajeffhao while (it.HasNext() && *shorty != '\0') { 1726bb836e14541d5424328182f3e20ce08c691d041eAndreas Gampe if (!CheckIndex(it.GetTypeIdx(), dex_file_->NumTypeIds(), 1727bb836e14541d5424328182f3e20ce08c691d041eAndreas Gampe "inter_proto_id_item shorty type_idx")) { 1728bb836e14541d5424328182f3e20ce08c691d041eAndreas Gampe return false; 1729bb836e14541d5424328182f3e20ce08c691d041eAndreas Gampe } 173010037c866b04550fc5461058c398c2e3e509381ajeffhao const char* descriptor = it.GetDescriptor(); 173110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckShortyDescriptorMatch(*shorty, descriptor, false)) { 173210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 173310037c866b04550fc5461058c398c2e3e509381ajeffhao } 173410037c866b04550fc5461058c398c2e3e509381ajeffhao it.Next(); 173510037c866b04550fc5461058c398c2e3e509381ajeffhao shorty++; 173610037c866b04550fc5461058c398c2e3e509381ajeffhao } 17378d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(it.HasNext() || *shorty != '\0')) { 17388d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched length for parameters and shorty"); 173910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 174010037c866b04550fc5461058c398c2e3e509381ajeffhao } 174110037c866b04550fc5461058c398c2e3e509381ajeffhao 174210037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. This relies on type_ids being in order. 17432cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (previous_item_ != nullptr) { 174410037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ProtoId* prev = reinterpret_cast<const DexFile::ProtoId*>(previous_item_); 17458d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev->return_type_idx_ > item->return_type_idx_)) { 17468d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order proto_id return types"); 174710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 174810037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev->return_type_idx_ == item->return_type_idx_) { 174910037c866b04550fc5461058c398c2e3e509381ajeffhao DexFileParameterIterator curr_it(*dex_file_, *item); 175010037c866b04550fc5461058c398c2e3e509381ajeffhao DexFileParameterIterator prev_it(*dex_file_, *prev); 175110037c866b04550fc5461058c398c2e3e509381ajeffhao 175210037c866b04550fc5461058c398c2e3e509381ajeffhao while (curr_it.HasNext() && prev_it.HasNext()) { 175310037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t prev_idx = prev_it.GetTypeIdx(); 175410037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t curr_idx = curr_it.GetTypeIdx(); 175510037c866b04550fc5461058c398c2e3e509381ajeffhao if (prev_idx == DexFile::kDexNoIndex16) { 175610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 175710037c866b04550fc5461058c398c2e3e509381ajeffhao } 17588d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(curr_idx == DexFile::kDexNoIndex16)) { 17598d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order proto_id arguments"); 176010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 176110037c866b04550fc5461058c398c2e3e509381ajeffhao } 176210037c866b04550fc5461058c398c2e3e509381ajeffhao 176310037c866b04550fc5461058c398c2e3e509381ajeffhao if (prev_idx < curr_idx) { 176410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 17658d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } else if (UNLIKELY(prev_idx > curr_idx)) { 17668d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order proto_id arguments"); 176710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 176810037c866b04550fc5461058c398c2e3e509381ajeffhao } 176910037c866b04550fc5461058c398c2e3e509381ajeffhao 177010037c866b04550fc5461058c398c2e3e509381ajeffhao prev_it.Next(); 177110037c866b04550fc5461058c398c2e3e509381ajeffhao curr_it.Next(); 177210037c866b04550fc5461058c398c2e3e509381ajeffhao } 177310037c866b04550fc5461058c398c2e3e509381ajeffhao } 177410037c866b04550fc5461058c398c2e3e509381ajeffhao } 177510037c866b04550fc5461058c398c2e3e509381ajeffhao 177610037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ProtoId); 177710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 177810037c866b04550fc5461058c398c2e3e509381ajeffhao} 177910037c866b04550fc5461058c398c2e3e509381ajeffhao 178010037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterFieldIdItem() { 178110037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldId* item = reinterpret_cast<const DexFile::FieldId*>(ptr_); 178210037c866b04550fc5461058c398c2e3e509381ajeffhao 178310037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the class descriptor is valid. 1784e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(class_descriptor, item->class_idx_, "inter_field_id_item class_idx") 1785e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(class_descriptor) || class_descriptor[0] != 'L')) { 1786e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid descriptor for class_idx: '%s'", class_descriptor); 178710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 178810037c866b04550fc5461058c398c2e3e509381ajeffhao } 178910037c866b04550fc5461058c398c2e3e509381ajeffhao 179010037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the type descriptor is a valid field name. 1791e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(type_descriptor, item->type_idx_, "inter_field_id_item type_idx") 1792e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(type_descriptor) || type_descriptor[0] == 'V')) { 1793e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid descriptor for type_idx: '%s'", type_descriptor); 179410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 179510037c866b04550fc5461058c398c2e3e509381ajeffhao } 179610037c866b04550fc5461058c398c2e3e509381ajeffhao 179710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the name is valid. 1798e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING(descriptor, item->name_idx_, "inter_field_id_item name_idx") 17998d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidMemberName(descriptor))) { 18008d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid field name: '%s'", descriptor); 180110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 180210037c866b04550fc5461058c398c2e3e509381ajeffhao } 180310037c866b04550fc5461058c398c2e3e509381ajeffhao 180410037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. This relies on the other sections being in order. 18052cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (previous_item_ != nullptr) { 180610037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldId* prev_item = reinterpret_cast<const DexFile::FieldId*>(previous_item_); 18078d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->class_idx_ > item->class_idx_)) { 18088d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_ids"); 180910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 181010037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->class_idx_ == item->class_idx_) { 18118d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->name_idx_ > item->name_idx_)) { 18128d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_ids"); 181310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 181410037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->name_idx_ == item->name_idx_) { 18158d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->type_idx_ >= item->type_idx_)) { 18168d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_ids"); 181710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 181810037c866b04550fc5461058c398c2e3e509381ajeffhao } 181910037c866b04550fc5461058c398c2e3e509381ajeffhao } 182010037c866b04550fc5461058c398c2e3e509381ajeffhao } 182110037c866b04550fc5461058c398c2e3e509381ajeffhao } 182210037c866b04550fc5461058c398c2e3e509381ajeffhao 182310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::FieldId); 182410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 182510037c866b04550fc5461058c398c2e3e509381ajeffhao} 182610037c866b04550fc5461058c398c2e3e509381ajeffhao 182710037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterMethodIdItem() { 182810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodId* item = reinterpret_cast<const DexFile::MethodId*>(ptr_); 182910037c866b04550fc5461058c398c2e3e509381ajeffhao 183010037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the class descriptor is a valid reference name. 1831e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(class_descriptor, item->class_idx_, "inter_method_id_item class_idx") 1832e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(class_descriptor) || (class_descriptor[0] != 'L' && 1833e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe class_descriptor[0] != '['))) { 1834e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid descriptor for class_idx: '%s'", class_descriptor); 183510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 183610037c866b04550fc5461058c398c2e3e509381ajeffhao } 183710037c866b04550fc5461058c398c2e3e509381ajeffhao 183810037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the name is valid. 1839df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe LOAD_STRING(descriptor, item->name_idx_, "inter_method_id_item name_idx") 18408d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidMemberName(descriptor))) { 18418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid method name: '%s'", descriptor); 184210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 184310037c866b04550fc5461058c398c2e3e509381ajeffhao } 184410037c866b04550fc5461058c398c2e3e509381ajeffhao 1845df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe // Check that the proto id is valid. 1846df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(!CheckIndex(item->proto_idx_, dex_file_->NumProtoIds(), 1847df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe "inter_method_id_item proto_idx"))) { 1848df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe return false; 1849df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe } 1850df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe 185110037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. This relies on the other sections being in order. 18522cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (previous_item_ != nullptr) { 185310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodId* prev_item = reinterpret_cast<const DexFile::MethodId*>(previous_item_); 18548d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->class_idx_ > item->class_idx_)) { 18558d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_ids"); 185610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 185710037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->class_idx_ == item->class_idx_) { 18588d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->name_idx_ > item->name_idx_)) { 18598d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_ids"); 186010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 186110037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->name_idx_ == item->name_idx_) { 18628d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->proto_idx_ >= item->proto_idx_)) { 18638d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_ids"); 186410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 186510037c866b04550fc5461058c398c2e3e509381ajeffhao } 186610037c866b04550fc5461058c398c2e3e509381ajeffhao } 186710037c866b04550fc5461058c398c2e3e509381ajeffhao } 186810037c866b04550fc5461058c398c2e3e509381ajeffhao } 186910037c866b04550fc5461058c398c2e3e509381ajeffhao 187010037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::MethodId); 187110037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 187210037c866b04550fc5461058c398c2e3e509381ajeffhao} 187310037c866b04550fc5461058c398c2e3e509381ajeffhao 187410037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterClassDefItem() { 187510037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ClassDef* item = reinterpret_cast<const DexFile::ClassDef*>(ptr_); 187610037c866b04550fc5461058c398c2e3e509381ajeffhao 18770ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe // Check for duplicate class def. 18780ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe if (defined_classes_.find(item->class_idx_) != defined_classes_.end()) { 18790ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe ErrorStringPrintf("Redefinition of class with type idx: '%d'", item->class_idx_); 18800ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe return false; 18810ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe } 18820ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe defined_classes_.insert(item->class_idx_); 18830ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe 1884e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(class_descriptor, item->class_idx_, "inter_class_def_item class_idx") 1885e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(class_descriptor) || class_descriptor[0] != 'L')) { 1886e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid class descriptor: '%s'", class_descriptor); 188710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 188810037c866b04550fc5461058c398c2e3e509381ajeffhao } 188910037c866b04550fc5461058c398c2e3e509381ajeffhao 1890acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe // Only allow non-runtime modifiers. 1891acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe if ((item->access_flags_ & ~kAccJavaFlagsMask) != 0) { 1892acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe ErrorStringPrintf("Invalid class flags: '%d'", item->access_flags_); 1893acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe return false; 1894acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe } 1895acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe 189610037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->interfaces_off_ != 0 && 189710037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->interfaces_off_, DexFile::kDexTypeTypeList)) { 189810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 189910037c866b04550fc5461058c398c2e3e509381ajeffhao } 190010037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->annotations_off_ != 0 && 190110037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->annotations_off_, DexFile::kDexTypeAnnotationsDirectoryItem)) { 190210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 190310037c866b04550fc5461058c398c2e3e509381ajeffhao } 190410037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->class_data_off_ != 0 && 190510037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->class_data_off_, DexFile::kDexTypeClassDataItem)) { 190610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 190710037c866b04550fc5461058c398c2e3e509381ajeffhao } 190810037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->static_values_off_ != 0 && 190910037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->static_values_off_, DexFile::kDexTypeEncodedArrayItem)) { 191010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 191110037c866b04550fc5461058c398c2e3e509381ajeffhao } 191210037c866b04550fc5461058c398c2e3e509381ajeffhao 191310037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->superclass_idx_ != DexFile::kDexNoIndex16) { 1914e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(superclass_descriptor, item->superclass_idx_, 1915e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe "inter_class_def_item superclass_idx") 1916e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(superclass_descriptor) || superclass_descriptor[0] != 'L')) { 1917e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid superclass: '%s'", superclass_descriptor); 191810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 191910037c866b04550fc5461058c398c2e3e509381ajeffhao } 192010037c866b04550fc5461058c398c2e3e509381ajeffhao } 192110037c866b04550fc5461058c398c2e3e509381ajeffhao 192210037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TypeList* interfaces = dex_file_->GetInterfacesList(*item); 19232cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (interfaces != nullptr) { 192410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = interfaces->Size(); 192510037c866b04550fc5461058c398c2e3e509381ajeffhao 192610037c866b04550fc5461058c398c2e3e509381ajeffhao // Ensure that all interfaces refer to classes (not arrays or primitives). 192710037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < size; i++) { 1928e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(inf_descriptor, interfaces->GetTypeItem(i).type_idx_, 1929e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe "inter_class_def_item interface type_idx") 1930e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(inf_descriptor) || inf_descriptor[0] != 'L')) { 1931e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid interface: '%s'", inf_descriptor); 193210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 193310037c866b04550fc5461058c398c2e3e509381ajeffhao } 193410037c866b04550fc5461058c398c2e3e509381ajeffhao } 193510037c866b04550fc5461058c398c2e3e509381ajeffhao 193610037c866b04550fc5461058c398c2e3e509381ajeffhao /* 193710037c866b04550fc5461058c398c2e3e509381ajeffhao * Ensure that there are no duplicates. This is an O(N^2) test, but in 193810037c866b04550fc5461058c398c2e3e509381ajeffhao * practice the number of interfaces implemented by any given class is low. 193910037c866b04550fc5461058c398c2e3e509381ajeffhao */ 194010037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 1; i < size; i++) { 194110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx1 = interfaces->GetTypeItem(i).type_idx_; 194210037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t j =0; j < i; j++) { 194310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx2 = interfaces->GetTypeItem(j).type_idx_; 19448d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(idx1 == idx2)) { 19458d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Duplicate interface: '%s'", dex_file_->StringByTypeIdx(idx1)); 194610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 194710037c866b04550fc5461058c398c2e3e509381ajeffhao } 194810037c866b04550fc5461058c398c2e3e509381ajeffhao } 194910037c866b04550fc5461058c398c2e3e509381ajeffhao } 195010037c866b04550fc5461058c398c2e3e509381ajeffhao } 195110037c866b04550fc5461058c398c2e3e509381ajeffhao 195210037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that references in class_data_item are to the right class. 195310037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->class_data_off_ != 0) { 195413735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* data = begin_ + item->class_data_off_; 19555e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe bool success; 19565e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe uint16_t data_definer = FindFirstClassDataDefiner(data, &success); 19575e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe if (!success) { 1958e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; 1959e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 19608d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((data_definer != item->class_idx_) && (data_definer != DexFile::kDexNoIndex16))) { 19618d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid class_data_item"); 196210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 196310037c866b04550fc5461058c398c2e3e509381ajeffhao } 196410037c866b04550fc5461058c398c2e3e509381ajeffhao } 196510037c866b04550fc5461058c398c2e3e509381ajeffhao 196610037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that references in annotations_directory_item are to right class. 196710037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->annotations_off_ != 0) { 196813735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* data = begin_ + item->annotations_off_; 19695e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe bool success; 19705e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe uint16_t annotations_definer = FindFirstAnnotationsDirectoryDefiner(data, &success); 19715e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe if (!success) { 1972e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; 1973e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 19748d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((annotations_definer != item->class_idx_) && 19758d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers (annotations_definer != DexFile::kDexNoIndex16))) { 19768d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid annotations_directory_item"); 197710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 197810037c866b04550fc5461058c398c2e3e509381ajeffhao } 197910037c866b04550fc5461058c398c2e3e509381ajeffhao } 198010037c866b04550fc5461058c398c2e3e509381ajeffhao 198110037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ClassDef); 198210037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 198310037c866b04550fc5461058c398c2e3e509381ajeffhao} 198410037c866b04550fc5461058c398c2e3e509381ajeffhao 198510037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterAnnotationSetRefList() { 198610037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationSetRefList* list = 198710037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationSetRefList*>(ptr_); 198810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationSetRefItem* item = list->list_; 198910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = list->size_; 199010037c866b04550fc5461058c398c2e3e509381ajeffhao 199110037c866b04550fc5461058c398c2e3e509381ajeffhao while (count--) { 199210037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->annotations_off_ != 0 && 199310037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 199410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 199510037c866b04550fc5461058c398c2e3e509381ajeffhao } 199610037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 199710037c866b04550fc5461058c398c2e3e509381ajeffhao } 199810037c866b04550fc5461058c398c2e3e509381ajeffhao 199913735955f39b3b304c37d2b2840663c131262c18Ian Rogers ptr_ = reinterpret_cast<const uint8_t*>(item); 200010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 200110037c866b04550fc5461058c398c2e3e509381ajeffhao} 200210037c866b04550fc5461058c398c2e3e509381ajeffhao 200310037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterAnnotationSetItem() { 200410037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationSetItem* set = reinterpret_cast<const DexFile::AnnotationSetItem*>(ptr_); 200510037c866b04550fc5461058c398c2e3e509381ajeffhao const uint32_t* offsets = set->entries_; 200610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = set->size_; 200710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_idx = 0; 200810037c866b04550fc5461058c398c2e3e509381ajeffhao 200910037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < count; i++) { 201010037c866b04550fc5461058c398c2e3e509381ajeffhao if (*offsets != 0 && !CheckOffsetToTypeMap(*offsets, DexFile::kDexTypeAnnotationItem)) { 201110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 201210037c866b04550fc5461058c398c2e3e509381ajeffhao } 201310037c866b04550fc5461058c398c2e3e509381ajeffhao 201410037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the annotation from the offset and the type index for the annotation. 201510037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationItem* annotation = 201630fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers reinterpret_cast<const DexFile::AnnotationItem*>(begin_ + *offsets); 201710037c866b04550fc5461058c398c2e3e509381ajeffhao const uint8_t* data = annotation->annotation_; 201810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = DecodeUnsignedLeb128(&data); 201910037c866b04550fc5461058c398c2e3e509381ajeffhao 20208d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= idx && i != 0)) { 20218d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order entry types: %x then %x", last_idx, idx); 202210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 202310037c866b04550fc5461058c398c2e3e509381ajeffhao } 202410037c866b04550fc5461058c398c2e3e509381ajeffhao 202510037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = idx; 202610037c866b04550fc5461058c398c2e3e509381ajeffhao offsets++; 202710037c866b04550fc5461058c398c2e3e509381ajeffhao } 202810037c866b04550fc5461058c398c2e3e509381ajeffhao 202913735955f39b3b304c37d2b2840663c131262c18Ian Rogers ptr_ = reinterpret_cast<const uint8_t*>(offsets); 203010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 203110037c866b04550fc5461058c398c2e3e509381ajeffhao} 203210037c866b04550fc5461058c398c2e3e509381ajeffhao 203310037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterClassDataItem() { 203410037c866b04550fc5461058c398c2e3e509381ajeffhao ClassDataItemIterator it(*dex_file_, ptr_); 20355e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe bool success; 20365e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe uint16_t defining_class = FindFirstClassDataDefiner(ptr_, &success); 20375e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe if (!success) { 2038e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; 2039e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 204010037c866b04550fc5461058c398c2e3e509381ajeffhao 204110037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextStaticField() || it.HasNextInstanceField(); it.Next()) { 20425e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_FIELD(field, it.GetMemberIndex(), "inter_class_data_item field_id", return false) 2043e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(field->class_idx_ != defining_class)) { 20448d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for class_data_item field"); 204510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 204610037c866b04550fc5461058c398c2e3e509381ajeffhao } 204710037c866b04550fc5461058c398c2e3e509381ajeffhao } 204810037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextDirectMethod() || it.HasNextVirtualMethod(); it.Next()) { 204910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t code_off = it.GetMethodCodeItemOffset(); 205010037c866b04550fc5461058c398c2e3e509381ajeffhao if (code_off != 0 && !CheckOffsetToTypeMap(code_off, DexFile::kDexTypeCodeItem)) { 205110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 205210037c866b04550fc5461058c398c2e3e509381ajeffhao } 20535e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_METHOD(method, it.GetMemberIndex(), "inter_class_data_item method_id", return false) 2054e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(method->class_idx_ != defining_class)) { 20558d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for class_data_item method"); 205610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 205710037c866b04550fc5461058c398c2e3e509381ajeffhao } 205810037c866b04550fc5461058c398c2e3e509381ajeffhao } 205910037c866b04550fc5461058c398c2e3e509381ajeffhao 206010037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = it.EndDataPointer(); 206110037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 206210037c866b04550fc5461058c398c2e3e509381ajeffhao} 206310037c866b04550fc5461058c398c2e3e509381ajeffhao 206410037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterAnnotationsDirectoryItem() { 206510037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationsDirectoryItem* item = 206610037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationsDirectoryItem*>(ptr_); 20675e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe bool success; 20685e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe uint16_t defining_class = FindFirstAnnotationsDirectoryDefiner(ptr_, &success); 20695e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe if (!success) { 2070e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; 2071e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 207210037c866b04550fc5461058c398c2e3e509381ajeffhao 207310037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->class_annotations_off_ != 0 && 207410037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->class_annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 207510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 207610037c866b04550fc5461058c398c2e3e509381ajeffhao } 207710037c866b04550fc5461058c398c2e3e509381ajeffhao 207810037c866b04550fc5461058c398c2e3e509381ajeffhao // Field annotations follow immediately after the annotations directory. 207910037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldAnnotationsItem* field_item = 208010037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::FieldAnnotationsItem*>(item + 1); 208110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t field_count = item->fields_size_; 208210037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < field_count; i++) { 20835e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_FIELD(field, field_item->field_idx_, "inter_annotations_directory_item field_id", 20845e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe return false) 2085e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(field->class_idx_ != defining_class)) { 20868d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for field_annotation"); 208710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 208810037c866b04550fc5461058c398c2e3e509381ajeffhao } 208910037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckOffsetToTypeMap(field_item->annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 209010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 209110037c866b04550fc5461058c398c2e3e509381ajeffhao } 209210037c866b04550fc5461058c398c2e3e509381ajeffhao field_item++; 209310037c866b04550fc5461058c398c2e3e509381ajeffhao } 209410037c866b04550fc5461058c398c2e3e509381ajeffhao 209510037c866b04550fc5461058c398c2e3e509381ajeffhao // Method annotations follow immediately after field annotations. 209610037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodAnnotationsItem* method_item = 209710037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::MethodAnnotationsItem*>(field_item); 209810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t method_count = item->methods_size_; 209910037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < method_count; i++) { 2100e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_METHOD(method, method_item->method_idx_, "inter_annotations_directory_item method_id", 21015e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe return false) 2102e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(method->class_idx_ != defining_class)) { 21038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for method_annotation"); 210410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 210510037c866b04550fc5461058c398c2e3e509381ajeffhao } 210610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckOffsetToTypeMap(method_item->annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 210710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 210810037c866b04550fc5461058c398c2e3e509381ajeffhao } 210910037c866b04550fc5461058c398c2e3e509381ajeffhao method_item++; 211010037c866b04550fc5461058c398c2e3e509381ajeffhao } 211110037c866b04550fc5461058c398c2e3e509381ajeffhao 211210037c866b04550fc5461058c398c2e3e509381ajeffhao // Parameter annotations follow immediately after method annotations. 211310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ParameterAnnotationsItem* parameter_item = 211410037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::ParameterAnnotationsItem*>(method_item); 211510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameter_count = item->parameters_size_; 211610037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < parameter_count; i++) { 2117e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_METHOD(parameter_method, parameter_item->method_idx_, 21185e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe "inter_annotations_directory_item parameter method_id", return false) 2119e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(parameter_method->class_idx_ != defining_class)) { 21208d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for parameter_annotation"); 212110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 212210037c866b04550fc5461058c398c2e3e509381ajeffhao } 21232b87ddf36abff711fa2233c49bffc7ceb03b15d7Dragos Sbirlea if (!CheckOffsetToTypeMap(parameter_item->annotations_off_, 21242b87ddf36abff711fa2233c49bffc7ceb03b15d7Dragos Sbirlea DexFile::kDexTypeAnnotationSetRefList)) { 212510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 212610037c866b04550fc5461058c398c2e3e509381ajeffhao } 212710037c866b04550fc5461058c398c2e3e509381ajeffhao parameter_item++; 212810037c866b04550fc5461058c398c2e3e509381ajeffhao } 212910037c866b04550fc5461058c398c2e3e509381ajeffhao 213013735955f39b3b304c37d2b2840663c131262c18Ian Rogers ptr_ = reinterpret_cast<const uint8_t*>(parameter_item); 213110037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 213210037c866b04550fc5461058c398c2e3e509381ajeffhao} 213310037c866b04550fc5461058c398c2e3e509381ajeffhao 21348a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckInterSectionIterate(size_t offset, uint32_t count, uint16_t type) { 213510037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the right alignment mask for the type of section. 21368a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t alignment_mask; 213710037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 213810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 213910037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint8_t) - 1; 214010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 214110037c866b04550fc5461058c398c2e3e509381ajeffhao default: 214210037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint32_t) - 1; 214310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 214410037c866b04550fc5461058c398c2e3e509381ajeffhao } 214510037c866b04550fc5461058c398c2e3e509381ajeffhao 214610037c866b04550fc5461058c398c2e3e509381ajeffhao // Iterate through the items in the section. 21472cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier previous_item_ = nullptr; 214810037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < count; i++) { 214910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t new_offset = (offset + alignment_mask) & ~alignment_mask; 215030fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers ptr_ = begin_ + new_offset; 215113735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* prev_ptr = ptr_; 215210037c866b04550fc5461058c398c2e3e509381ajeffhao 215310037c866b04550fc5461058c398c2e3e509381ajeffhao // Check depending on the section type. 215410037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 215510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: { 215610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterStringIdItem()) { 215710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 215810037c866b04550fc5461058c398c2e3e509381ajeffhao } 215910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 216010037c866b04550fc5461058c398c2e3e509381ajeffhao } 216110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: { 216210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterTypeIdItem()) { 216310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 216410037c866b04550fc5461058c398c2e3e509381ajeffhao } 216510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 216610037c866b04550fc5461058c398c2e3e509381ajeffhao } 216710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: { 216810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterProtoIdItem()) { 216910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 217010037c866b04550fc5461058c398c2e3e509381ajeffhao } 217110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 217210037c866b04550fc5461058c398c2e3e509381ajeffhao } 217310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: { 217410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterFieldIdItem()) { 217510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 217610037c866b04550fc5461058c398c2e3e509381ajeffhao } 217710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 217810037c866b04550fc5461058c398c2e3e509381ajeffhao } 217910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: { 218010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterMethodIdItem()) { 218110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 218210037c866b04550fc5461058c398c2e3e509381ajeffhao } 218310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 218410037c866b04550fc5461058c398c2e3e509381ajeffhao } 218510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: { 218610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterClassDefItem()) { 218710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 218810037c866b04550fc5461058c398c2e3e509381ajeffhao } 218910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 219010037c866b04550fc5461058c398c2e3e509381ajeffhao } 219110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: { 219210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterAnnotationSetRefList()) { 219310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 219410037c866b04550fc5461058c398c2e3e509381ajeffhao } 219510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 219610037c866b04550fc5461058c398c2e3e509381ajeffhao } 219710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: { 219810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterAnnotationSetItem()) { 219910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 220010037c866b04550fc5461058c398c2e3e509381ajeffhao } 220110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 220210037c866b04550fc5461058c398c2e3e509381ajeffhao } 220310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: { 220410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterClassDataItem()) { 220510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 220610037c866b04550fc5461058c398c2e3e509381ajeffhao } 220710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 220810037c866b04550fc5461058c398c2e3e509381ajeffhao } 220910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: { 221010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterAnnotationsDirectoryItem()) { 221110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 221210037c866b04550fc5461058c398c2e3e509381ajeffhao } 221310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 221410037c866b04550fc5461058c398c2e3e509381ajeffhao } 221510037c866b04550fc5461058c398c2e3e509381ajeffhao default: 22168d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 221710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 221810037c866b04550fc5461058c398c2e3e509381ajeffhao } 221910037c866b04550fc5461058c398c2e3e509381ajeffhao 222010037c866b04550fc5461058c398c2e3e509381ajeffhao previous_item_ = prev_ptr; 22218a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers offset = ptr_ - begin_; 222210037c866b04550fc5461058c398c2e3e509381ajeffhao } 222310037c866b04550fc5461058c398c2e3e509381ajeffhao 222410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 222510037c866b04550fc5461058c398c2e3e509381ajeffhao} 222610037c866b04550fc5461058c398c2e3e509381ajeffhao 222710037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterSection() { 222830fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers const DexFile::MapList* map = reinterpret_cast<const DexFile::MapList*>(begin_ + header_->map_off_); 222910037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MapItem* item = map->list_; 223010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = map->size_; 223110037c866b04550fc5461058c398c2e3e509381ajeffhao 223210037c866b04550fc5461058c398c2e3e509381ajeffhao // Cross check the items listed in the map. 223310037c866b04550fc5461058c398c2e3e509381ajeffhao while (count--) { 223410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_offset = item->offset_; 223510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_count = item->size_; 223610037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t type = item->type_; 223710037c866b04550fc5461058c398c2e3e509381ajeffhao 223810037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 223910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: 224010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMapList: 224110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: 224210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: 224310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: 224410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: 224510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: 224610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: 224710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 224810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 224910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 225010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 225110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 225210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 225310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 225410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: 225510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: 225610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 225710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: { 225810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterSectionIterate(section_offset, section_count, type)) { 225910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 226010037c866b04550fc5461058c398c2e3e509381ajeffhao } 226110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 226210037c866b04550fc5461058c398c2e3e509381ajeffhao } 226310037c866b04550fc5461058c398c2e3e509381ajeffhao default: 22648d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 226510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 226610037c866b04550fc5461058c398c2e3e509381ajeffhao } 226710037c866b04550fc5461058c398c2e3e509381ajeffhao 226810037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 226910037c866b04550fc5461058c398c2e3e509381ajeffhao } 227010037c866b04550fc5461058c398c2e3e509381ajeffhao 227110037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 227210037c866b04550fc5461058c398c2e3e509381ajeffhao} 227310037c866b04550fc5461058c398c2e3e509381ajeffhao 227410037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::Verify() { 227510037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the header. 227610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckHeader()) { 227710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 227810037c866b04550fc5461058c398c2e3e509381ajeffhao } 227910037c866b04550fc5461058c398c2e3e509381ajeffhao 228010037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the map section. 228110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckMap()) { 228210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 228310037c866b04550fc5461058c398c2e3e509381ajeffhao } 228410037c866b04550fc5461058c398c2e3e509381ajeffhao 228510037c866b04550fc5461058c398c2e3e509381ajeffhao // Check structure within remaining sections. 228610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraSection()) { 228710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 228810037c866b04550fc5461058c398c2e3e509381ajeffhao } 228910037c866b04550fc5461058c398c2e3e509381ajeffhao 229010037c866b04550fc5461058c398c2e3e509381ajeffhao // Check references from one section to another. 229110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterSection()) { 229210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 229310037c866b04550fc5461058c398c2e3e509381ajeffhao } 229410037c866b04550fc5461058c398c2e3e509381ajeffhao 229510037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 229610037c866b04550fc5461058c398c2e3e509381ajeffhao} 229710037c866b04550fc5461058c398c2e3e509381ajeffhao 22988d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersvoid DexFileVerifier::ErrorStringPrintf(const char* fmt, ...) { 22998d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers va_list ap; 23008d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers va_start(ap, fmt); 23018d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers DCHECK(failure_reason_.empty()) << failure_reason_; 23028d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers failure_reason_ = StringPrintf("Failure to verify dex file '%s': ", location_); 23038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers StringAppendV(&failure_reason_, fmt, ap); 23048d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers va_end(ap); 23058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers} 23068d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers 2307e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe// Fields and methods may have only one of public/protected/private. 2308e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampestatic bool CheckAtMostOneOfPublicProtectedPrivate(uint32_t flags) { 2309e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe size_t count = (((flags & kAccPublic) == 0) ? 0 : 1) + 2310e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (((flags & kAccProtected) == 0) ? 0 : 1) + 2311e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (((flags & kAccPrivate) == 0) ? 0 : 1); 2312e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return count <= 1; 2313e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 2314e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2315e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::CheckFieldAccessFlags(uint32_t field_access_flags, 2316e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t class_access_flags, 2317e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::string* error_msg) { 2318e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Generally sort out >16-bit flags. 2319e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((field_access_flags & ~kAccJavaFlagsMask) != 0) { 2320e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Bad class_data_item field access_flags %x", field_access_flags); 2321e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2322e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2323e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2324e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Flags allowed on fields, in general. Other lower-16-bit flags are to be ignored. 2325e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr uint32_t kFieldAccessFlags = kAccPublic | 2326e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccPrivate | 2327e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccProtected | 2328e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccStatic | 2329e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccFinal | 2330e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccVolatile | 2331e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccTransient | 2332e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccSynthetic | 2333e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccEnum; 2334e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2335e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Fields may have only one of public/protected/final. 2336e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckAtMostOneOfPublicProtectedPrivate(field_access_flags)) { 2337e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Field may have only one of public/protected/private, %x", 2338e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe field_access_flags); 2339e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2340e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2341e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2342e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Interfaces have a pretty restricted list. 2343e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((class_access_flags & kAccInterface) != 0) { 2344e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Interface fields must be public final static. 2345e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr uint32_t kPublicFinalStatic = kAccPublic | kAccFinal | kAccStatic; 2346e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((field_access_flags & kPublicFinalStatic) != kPublicFinalStatic) { 2347e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Interface field is not public final static: %x", 2348e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe field_access_flags); 2349e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2350e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2351e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Interface fields may be synthetic, but may not have other flags. 2352e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr uint32_t kDisallowed = ~(kPublicFinalStatic | kAccSynthetic); 2353e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((field_access_flags & kFieldAccessFlags & kDisallowed) != 0) { 2354e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Interface field has disallowed flag: %x", field_access_flags); 2355e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2356e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2357e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 2358e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2359e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2360e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Volatile fields may not be final. 2361e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr uint32_t kVolatileFinal = kAccVolatile | kAccFinal; 2362e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((field_access_flags & kVolatileFinal) == kVolatileFinal) { 2363e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = "Fields may not be volatile and final"; 2364e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2365e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2366e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2367e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 2368e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 2369e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2370e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe// Try to find the name of the method with the given index. We do not want to rely on DexFile 2371e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe// infrastructure at this point, so do it all by hand. begin and header correspond to begin_ and 2372e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe// header_ of the DexFileVerifier. str will contain the pointer to the method name on success 2373e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe// (flagged by the return value), otherwise error_msg will contain an error string. 2374e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampestatic bool FindMethodName(uint32_t method_index, 2375e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const uint8_t* begin, 2376e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const DexFile::Header* header, 2377e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const char** str, 2378e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::string* error_msg) { 2379e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (method_index >= header->method_ids_size_) { 2380e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = "Method index not available for method flags verification"; 2381e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2382e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2383e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t string_idx = 2384e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (reinterpret_cast<const DexFile::MethodId*>(begin + header->method_ids_off_) + 2385e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_index)->name_idx_; 2386e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (string_idx >= header->string_ids_size_) { 2387e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = "String index not available for method flags verification"; 2388e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2389e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2390e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t string_off = 2391e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe (reinterpret_cast<const DexFile::StringId*>(begin + header->string_ids_off_) + string_idx)-> 2392e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe string_data_off_; 2393e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (string_off >= header->file_size_) { 2394e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = "String offset out of bounds for method flags verification"; 2395e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2396e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2397e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const uint8_t* str_data_ptr = begin + string_off; 2398e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe DecodeUnsignedLeb128(&str_data_ptr); 2399e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *str = reinterpret_cast<const char*>(str_data_ptr); 2400e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 2401e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 2402e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2403e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampebool DexFileVerifier::CheckMethodAccessFlags(uint32_t method_index, 2404e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t method_access_flags, 2405e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe uint32_t class_access_flags, 2406e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool has_code, 2407e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool expect_direct, 2408e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe std::string* error_msg) { 2409e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Generally sort out >16-bit flags, except dex knows Constructor and DeclaredSynchronized. 2410e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr uint32_t kAllMethodFlags = 2411e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccJavaFlagsMask | kAccConstructor | kAccDeclaredSynchronized; 2412e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((method_access_flags & ~kAllMethodFlags) != 0) { 2413e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Bad class_data_item method access_flags %x", method_access_flags); 2414e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2415e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2416e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2417e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Flags allowed on fields, in general. Other lower-16-bit flags are to be ignored. 2418e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr uint32_t kMethodAccessFlags = kAccPublic | 2419e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccPrivate | 2420e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccProtected | 2421e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccStatic | 2422e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccFinal | 2423e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccSynthetic | 2424e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccSynchronized | 2425e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccBridge | 2426e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccVarargs | 2427e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccNative | 2428e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccAbstract | 2429e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccStrict; 2430e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2431e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Methods may have only one of public/protected/final. 2432e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!CheckAtMostOneOfPublicProtectedPrivate(method_access_flags)) { 2433e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Method may have only one of public/protected/private, %x", 2434e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_access_flags); 2435e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2436e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2437e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2438e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Try to find the name, to check for constructor properties. 2439e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe const char* str; 2440e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!FindMethodName(method_index, begin_, header_, &str, error_msg)) { 2441e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2442e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2443e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool is_init_by_name = false; 2444e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr const char* kInitName = "<init>"; 2445e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe size_t str_offset = (reinterpret_cast<const uint8_t*>(str) - begin_); 2446e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (header_->file_size_ - str_offset >= sizeof(kInitName)) { 2447e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe is_init_by_name = strcmp(kInitName, str) == 0; 2448e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2449e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool is_clinit_by_name = false; 2450e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr const char* kClinitName = "<clinit>"; 2451e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (header_->file_size_ - str_offset >= sizeof(kClinitName)) { 2452e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe is_clinit_by_name = strcmp(kClinitName, str) == 0; 2453e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2454e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool is_constructor = is_init_by_name || is_clinit_by_name; 2455e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2456e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Only methods named "<clinit>" or "<init>" may be marked constructor. Note: we cannot enforce 2457e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // the reverse for backwards compatibility reasons. 2458e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (((method_access_flags & kAccConstructor) != 0) && !is_constructor) { 2459e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Method %" PRIu32 " is marked constructor, but doesn't match name", 2460e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_index); 2461e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2462e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2463e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check that the static constructor (= static initializer) is named "<clinit>" and that the 2464e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // instance constructor is called "<init>". 2465e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (is_constructor) { 2466e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool is_static = (method_access_flags & kAccStatic) != 0; 2467e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (is_static ^ is_clinit_by_name) { 2468e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Constructor %" PRIu32 " is not flagged correctly wrt/ static.", 2469e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_index); 2470e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2471e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2472e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2473e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Check that static and private methods, as well as constructors, are in the direct methods list, 2474e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // and other methods in the virtual methods list. 2475e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe bool is_direct = (method_access_flags & (kAccStatic | kAccPrivate)) != 0 || is_constructor; 2476e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (is_direct != expect_direct) { 2477e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Direct/virtual method %" PRIu32 " not in expected list %d", 2478e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_index, 2479e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe expect_direct); 2480e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2481e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2482e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2483e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2484e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // From here on out it is easier to mask out the bits we're supposed to ignore. 2485e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_access_flags &= kMethodAccessFlags; 2486e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2487e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // If there aren't any instructions, make sure that's expected. 2488e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (!has_code) { 2489e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Only native or abstract methods may not have code. 2490e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((method_access_flags & (kAccNative | kAccAbstract)) == 0) { 2491e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Method %" PRIu32 " has no code, but is not marked native or " 2492e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe "abstract", 2493e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_index); 2494e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2495e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2496e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Constructors must always have code. 2497e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (is_constructor) { 2498e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Constructor %u must not be abstract or native", method_index); 2499e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2500e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2501e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((method_access_flags & kAccAbstract) != 0) { 2502e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Abstract methods are not allowed to have the following flags. 2503e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe constexpr uint32_t kForbidden = 2504e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccPrivate | kAccStatic | kAccFinal | kAccNative | kAccStrict | kAccSynchronized; 2505e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((method_access_flags & kForbidden) != 0) { 2506e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Abstract method %" PRIu32 " has disallowed access flags %x", 2507e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_index, 2508e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_access_flags); 2509e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2510e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2511e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Abstract methods must be in an abstract class or interface. 2512e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((class_access_flags & (kAccInterface | kAccAbstract)) == 0) { 2513e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Method %" PRIu32 " is abstract, but the declaring class " 2514e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe "is neither abstract nor an interface", method_index); 2515e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2516e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2517e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2518e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Interfaces are special. 2519e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((class_access_flags & kAccInterface) != 0) { 2520e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Interface methods must be public and abstract. 2521e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((method_access_flags & (kAccPublic | kAccAbstract)) != (kAccPublic | kAccAbstract)) { 2522e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Interface method %" PRIu32 " is not public and abstract", 2523e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_index); 2524e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2525e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2526e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // At this point, we know the method is public and abstract. This means that all the checks 2527e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // for invalid combinations above applies. In addition, interface methods must not be 2528e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // protected. This is caught by the check for only-one-of-public-protected-private. 2529e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2530e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 2531e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2532e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2533e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // When there's code, the method must not be native or abstract. 2534e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((method_access_flags & (kAccNative | kAccAbstract)) != 0) { 2535e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Method %" PRIu32 " has code, but is marked native or abstract", 2536e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_index); 2537e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2538e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2539e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2540e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Only the static initializer may have code in an interface. 2541eb7c144a6aff7da673ba53d501c46f00311d4d7fAlex Light // TODO We should have some way determine whether to allow this experimental flag without the 2542eb7c144a6aff7da673ba53d501c46f00311d4d7fAlex Light // runtime being started. 2543eb7c144a6aff7da673ba53d501c46f00311d4d7fAlex Light // We assume experimental flags are enabled when running without a runtime to enable tools like 2544eb7c144a6aff7da673ba53d501c46f00311d4d7fAlex Light // dexdump to handle dex files with these features. 2545eb7c144a6aff7da673ba53d501c46f00311d4d7fAlex Light if (((class_access_flags & kAccInterface) != 0) 2546eb7c144a6aff7da673ba53d501c46f00311d4d7fAlex Light && !is_clinit_by_name 2547eb7c144a6aff7da673ba53d501c46f00311d4d7fAlex Light && Runtime::Current() != nullptr 2548eb7c144a6aff7da673ba53d501c46f00311d4d7fAlex Light && !Runtime::Current()->AreExperimentalFlagsEnabled(ExperimentalFlags::kDefaultMethods)) { 2549e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Non-clinit interface method %" PRIu32 " should not have code", 2550e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_index); 2551e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2552e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2553e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2554e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe // Instance constructors must not be synchronized and a few other flags. 2555e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if (is_init_by_name) { 2556e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe static constexpr uint32_t kInitAllowed = 2557e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe kAccPrivate | kAccProtected | kAccPublic | kAccStrict | kAccVarargs | kAccSynthetic; 2558e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe if ((method_access_flags & ~kInitAllowed) != 0) { 2559e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe *error_msg = StringPrintf("Constructor %" PRIu32 " flagged inappropriately %x", 2560e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_index, 2561e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe method_access_flags); 2562e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return false; 2563e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2564e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe } 2565e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 2566e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe return true; 2567e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe} 2568e6215c0ec4b1bb71b722fdbf7e62eaf3be8a91d5Andreas Gampe 256910037c866b04550fc5461058c398c2e3e509381ajeffhao} // namespace art 2570