dex_file_verifier.cc revision 6a8df53d90e47e3256faf7ff0caed0acf377b99b
12faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes/* 22faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * Copyright (C) 2011 The Android Open Source Project 32faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * 42faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * Licensed under the Apache License, Version 2.0 (the "License"); 52faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * you may not use this file except in compliance with the License. 62faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * You may obtain a copy of the License at 72faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * 82faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * http://www.apache.org/licenses/LICENSE-2.0 92faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * 102faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * Unless required by applicable law or agreed to in writing, software 112faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * distributed under the License is distributed on an "AS IS" BASIS, 122faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 132faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * See the License for the specific language governing permissions and 142faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * limitations under the License. 152faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes */ 1610037c866b04550fc5461058c398c2e3e509381ajeffhao 1710037c866b04550fc5461058c398c2e3e509381ajeffhao#include "dex_file_verifier.h" 1810037c866b04550fc5461058c398c2e3e509381ajeffhao 1992572be7f754c213e615a62955cc5f65ca8c0c0eNarayan Kamath#include <zlib.h> 20700a402244a1a423da4f3ba8032459f4b65fa18fIan Rogers#include <memory> 2192572be7f754c213e615a62955cc5f65ca8c0c0eNarayan Kamath 22e222ee0b794f941af4fb1b32fb8224e32942ea7bElliott Hughes#include "base/stringprintf.h" 234f6ad8ab428038129b2d0d6c40b7fd625cca15e1Ian Rogers#include "dex_file-inl.h" 2410037c866b04550fc5461058c398c2e3e509381ajeffhao#include "leb128.h" 25a0e180632411f7fe0edf454e571c42209ee7b540Elliott Hughes#include "safe_map.h" 26a67249065e4c9b3cf4a7c081d95a78df28291ee9Ian Rogers#include "utf-inl.h" 272dd0e2cea360bc9206eb88ecc40d259e796c239dIan Rogers#include "utils.h" 2810037c866b04550fc5461058c398c2e3e509381ajeffhao 2910037c866b04550fc5461058c398c2e3e509381ajeffhaonamespace art { 3010037c866b04550fc5461058c398c2e3e509381ajeffhao 3110037c866b04550fc5461058c398c2e3e509381ajeffhaostatic uint32_t MapTypeToBitMask(uint32_t map_type) { 3210037c866b04550fc5461058c398c2e3e509381ajeffhao switch (map_type) { 3310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: return 1 << 0; 3410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: return 1 << 1; 3510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: return 1 << 2; 3610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: return 1 << 3; 3710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: return 1 << 4; 3810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: return 1 << 5; 3910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: return 1 << 6; 4010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMapList: return 1 << 7; 4110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: return 1 << 8; 4210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: return 1 << 9; 4310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: return 1 << 10; 4410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: return 1 << 11; 4510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: return 1 << 12; 4610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: return 1 << 13; 4710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: return 1 << 14; 4810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: return 1 << 15; 4910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: return 1 << 16; 5010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: return 1 << 17; 5110037c866b04550fc5461058c398c2e3e509381ajeffhao } 5210037c866b04550fc5461058c398c2e3e509381ajeffhao return 0; 5310037c866b04550fc5461058c398c2e3e509381ajeffhao} 5410037c866b04550fc5461058c398c2e3e509381ajeffhao 5510037c866b04550fc5461058c398c2e3e509381ajeffhaostatic bool IsDataSectionType(uint32_t map_type) { 5610037c866b04550fc5461058c398c2e3e509381ajeffhao switch (map_type) { 5710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: 5810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 5910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 6010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 6110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 6210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 6310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 6410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 6510037c866b04550fc5461058c398c2e3e509381ajeffhao } 6610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 6710037c866b04550fc5461058c398c2e3e509381ajeffhao} 6810037c866b04550fc5461058c398c2e3e509381ajeffhao 69e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampeconst char* DexFileVerifier::CheckLoadStringByIdx(uint32_t idx, const char* error_string) { 70df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(!CheckIndex(idx, dex_file_->NumStringIds(), error_string))) { 71e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return nullptr; 72e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 73e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return dex_file_->StringDataByIdx(idx); 74e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe} 75e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 76e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampeconst char* DexFileVerifier::CheckLoadStringByTypeIdx(uint32_t type_idx, const char* error_string) { 77df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(!CheckIndex(type_idx, dex_file_->NumTypeIds(), error_string))) { 78e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return nullptr; 79e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 80e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe const DexFile::TypeId& type_id = dex_file_->GetTypeId(type_idx); 81e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe uint32_t idx = type_id.descriptor_idx_; 82e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return CheckLoadStringByIdx(idx, error_string); 83e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe} 84e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 85e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampeconst DexFile::FieldId* DexFileVerifier::CheckLoadFieldId(uint32_t idx, const char* error_string) { 86df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(!CheckIndex(idx, dex_file_->NumFieldIds(), error_string))) { 87e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return nullptr; 88e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 89e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return &dex_file_->GetFieldId(idx); 90e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe} 91e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 92e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampeconst DexFile::MethodId* DexFileVerifier::CheckLoadMethodId(uint32_t idx, const char* err_string) { 93df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(!CheckIndex(idx, dex_file_->NumMethodIds(), err_string))) { 94e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return nullptr; 95e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 96e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return &dex_file_->GetMethodId(idx); 97e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe} 98e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 99e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe// Helper macro to load string and return false on error. 100e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe#define LOAD_STRING(var, idx, error) \ 101e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe const char* var = CheckLoadStringByIdx(idx, error); \ 102df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(var == nullptr)) { \ 103e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; \ 104e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 105e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 106e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe// Helper macro to load string by type idx and return false on error. 107e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe#define LOAD_STRING_BY_TYPE(var, type_idx, error) \ 108e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe const char* var = CheckLoadStringByTypeIdx(type_idx, error); \ 109df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(var == nullptr)) { \ 110e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; \ 111e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 112e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 113e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe// Helper macro to load method id. Return last parameter on error. 1145e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe#define LOAD_METHOD(var, idx, error_string, error_stmt) \ 115e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe const DexFile::MethodId* var = CheckLoadMethodId(idx, error_string); \ 116df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(var == nullptr)) { \ 1175e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe error_stmt; \ 118e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 119e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 120e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe// Helper macro to load method id. Return last parameter on error. 1215e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe#define LOAD_FIELD(var, idx, fmt, error_stmt) \ 122e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe const DexFile::FieldId* var = CheckLoadFieldId(idx, fmt); \ 123df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(var == nullptr)) { \ 1245e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe error_stmt; \ 125e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 126e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 12713735955f39b3b304c37d2b2840663c131262c18Ian Rogersbool DexFileVerifier::Verify(const DexFile* dex_file, const uint8_t* begin, size_t size, 1288d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers const char* location, std::string* error_msg) { 129700a402244a1a423da4f3ba8032459f4b65fa18fIan Rogers std::unique_ptr<DexFileVerifier> verifier(new DexFileVerifier(dex_file, begin, size, location)); 1308d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (!verifier->Verify()) { 1318d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers *error_msg = verifier->FailureReason(); 1328d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers return false; 1338d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } 1348d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers return true; 1358d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers} 1368d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers 1378d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckShortyDescriptorMatch(char shorty_char, const char* descriptor, 1388d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers bool is_return_type) { 13910037c866b04550fc5461058c398c2e3e509381ajeffhao switch (shorty_char) { 14010037c866b04550fc5461058c398c2e3e509381ajeffhao case 'V': 1418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!is_return_type)) { 1428d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid use of void"); 14310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 14410037c866b04550fc5461058c398c2e3e509381ajeffhao } 145fc787ecd91127b2c8458afd94e5148e2ae51a1f5Ian Rogers FALLTHROUGH_INTENDED; 14610037c866b04550fc5461058c398c2e3e509381ajeffhao case 'B': 14710037c866b04550fc5461058c398c2e3e509381ajeffhao case 'C': 14810037c866b04550fc5461058c398c2e3e509381ajeffhao case 'D': 14910037c866b04550fc5461058c398c2e3e509381ajeffhao case 'F': 15010037c866b04550fc5461058c398c2e3e509381ajeffhao case 'I': 15110037c866b04550fc5461058c398c2e3e509381ajeffhao case 'J': 15210037c866b04550fc5461058c398c2e3e509381ajeffhao case 'S': 15310037c866b04550fc5461058c398c2e3e509381ajeffhao case 'Z': 1548d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((descriptor[0] != shorty_char) || (descriptor[1] != '\0'))) { 1558d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Shorty vs. primitive type mismatch: '%c', '%s'", 1568d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers shorty_char, descriptor); 15710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 15810037c866b04550fc5461058c398c2e3e509381ajeffhao } 15910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 16010037c866b04550fc5461058c398c2e3e509381ajeffhao case 'L': 1618d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((descriptor[0] != 'L') && (descriptor[0] != '['))) { 1628d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Shorty vs. type mismatch: '%c', '%s'", shorty_char, descriptor); 16310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 16410037c866b04550fc5461058c398c2e3e509381ajeffhao } 16510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 16610037c866b04550fc5461058c398c2e3e509381ajeffhao default: 1678d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad shorty character: '%c'", shorty_char); 16810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 16910037c866b04550fc5461058c398c2e3e509381ajeffhao } 17010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 17110037c866b04550fc5461058c398c2e3e509381ajeffhao} 17210037c866b04550fc5461058c398c2e3e509381ajeffhao 17350d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampebool DexFileVerifier::CheckListSize(const void* start, size_t count, size_t elem_size, 174d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe const char* label) { 17550d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe // Check that size is not 0. 17650d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe CHECK_NE(elem_size, 0U); 17750d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe 17813735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* range_start = reinterpret_cast<const uint8_t*>(start); 17913735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* file_start = reinterpret_cast<const uint8_t*>(begin_); 18050d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe 18150d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe // Check for overflow. 18250d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe uintptr_t max = 0 - 1; 18350d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe size_t available_bytes_till_end_of_mem = max - reinterpret_cast<uintptr_t>(start); 18450d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe size_t max_count = available_bytes_till_end_of_mem / elem_size; 18550d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (max_count < count) { 18650d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe ErrorStringPrintf("Overflow in range for %s: %zx for %zu@%zu", label, 18750d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe static_cast<size_t>(range_start - file_start), 18850d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe count, elem_size); 18950d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe return false; 19050d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe } 19150d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe 19213735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* range_end = range_start + count * elem_size; 19313735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* file_end = file_start + size_; 19450d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (UNLIKELY((range_start < file_start) || (range_end > file_end))) { 19550d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe // Note: these two tests are enough as we make sure above that there's no overflow. 1968a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Bad range for %s: %zx to %zx", label, 197e3d5581266301e6a672af6233220037abf52fea1Ian Rogers static_cast<size_t>(range_start - file_start), 198e3d5581266301e6a672af6233220037abf52fea1Ian Rogers static_cast<size_t>(range_end - file_start)); 19910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 20010037c866b04550fc5461058c398c2e3e509381ajeffhao } 20110037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 20210037c866b04550fc5461058c398c2e3e509381ajeffhao} 20310037c866b04550fc5461058c398c2e3e509381ajeffhao 20413735955f39b3b304c37d2b2840663c131262c18Ian Rogersbool DexFileVerifier::CheckList(size_t element_size, const char* label, const uint8_t* *ptr) { 205d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe // Check that the list is available. The first 4B are the count. 206d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckListSize(*ptr, 1, 4U, label)) { 207d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return false; 208d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 209d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 210d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe uint32_t count = *reinterpret_cast<const uint32_t*>(*ptr); 211d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (count > 0) { 212d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckListSize(*ptr + 4, count, element_size, label)) { 213d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return false; 214d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 215d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 216d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 217d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe *ptr += 4 + count * element_size; 218d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return true; 219d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe} 220d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 2218d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckIndex(uint32_t field, uint32_t limit, const char* label) { 2228d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(field >= limit)) { 2238d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad index for %s: %x >= %x", label, field, limit); 22410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 22510037c866b04550fc5461058c398c2e3e509381ajeffhao } 22610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 22710037c866b04550fc5461058c398c2e3e509381ajeffhao} 22810037c866b04550fc5461058c398c2e3e509381ajeffhao 229d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampebool DexFileVerifier::CheckValidOffsetAndSize(uint32_t offset, uint32_t size, const char* label) { 230d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (size == 0) { 231d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (offset != 0) { 232d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe ErrorStringPrintf("Offset(%d) should be zero when size is zero for %s.", offset, label); 233d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return false; 234d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 235d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 236d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (size_ <= offset) { 237d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe ErrorStringPrintf("Offset(%d) should be within file size(%zu) for %s.", offset, size_, label); 238d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return false; 239d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 240d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return true; 241d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe} 242d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 2438d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckHeader() { 244f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao // Check file size from the header. 245f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao uint32_t expected_size = header_->file_size_; 246f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao if (size_ != expected_size) { 2478d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad file size (%zd, expected %ud)", size_, expected_size); 24810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 24910037c866b04550fc5461058c398c2e3e509381ajeffhao } 25010037c866b04550fc5461058c398c2e3e509381ajeffhao 25110037c866b04550fc5461058c398c2e3e509381ajeffhao // Compute and verify the checksum in the header. 25210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t adler_checksum = adler32(0L, Z_NULL, 0); 25310037c866b04550fc5461058c398c2e3e509381ajeffhao const uint32_t non_sum = sizeof(header_->magic_) + sizeof(header_->checksum_); 25413735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* non_sum_ptr = reinterpret_cast<const uint8_t*>(header_) + non_sum; 255f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao adler_checksum = adler32(adler_checksum, non_sum_ptr, expected_size - non_sum); 25610037c866b04550fc5461058c398c2e3e509381ajeffhao if (adler_checksum != header_->checksum_) { 2578d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad checksum (%08x, expected %08x)", adler_checksum, header_->checksum_); 25810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 25910037c866b04550fc5461058c398c2e3e509381ajeffhao } 26010037c866b04550fc5461058c398c2e3e509381ajeffhao 26110037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the contents of the header. 26210037c866b04550fc5461058c398c2e3e509381ajeffhao if (header_->endian_tag_ != DexFile::kDexEndianConstant) { 2638d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unexpected endian_tag: %x", header_->endian_tag_); 26410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 26510037c866b04550fc5461058c398c2e3e509381ajeffhao } 26610037c866b04550fc5461058c398c2e3e509381ajeffhao 26710037c866b04550fc5461058c398c2e3e509381ajeffhao if (header_->header_size_ != sizeof(DexFile::Header)) { 2688d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad header size: %ud", header_->header_size_); 26910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 27010037c866b04550fc5461058c398c2e3e509381ajeffhao } 27110037c866b04550fc5461058c398c2e3e509381ajeffhao 272d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe // Check that all offsets are inside the file. 273d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe bool result = 274d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->link_off_, header_->link_size_, "link") && 275d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->map_off_, header_->map_off_, "map") && 276d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->string_ids_off_, header_->string_ids_size_, "string-ids") && 277d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->type_ids_off_, header_->type_ids_size_, "type-ids") && 278d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->proto_ids_off_, header_->proto_ids_size_, "proto-ids") && 279d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->field_ids_off_, header_->field_ids_size_, "field-ids") && 280d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->method_ids_off_, header_->method_ids_size_, "method-ids") && 281d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->class_defs_off_, header_->class_defs_size_, "class-defs") && 282d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe CheckValidOffsetAndSize(header_->data_off_, header_->data_size_, "data"); 283d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 284d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return result; 28510037c866b04550fc5461058c398c2e3e509381ajeffhao} 28610037c866b04550fc5461058c398c2e3e509381ajeffhao 2878d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckMap() { 288d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe const DexFile::MapList* map = reinterpret_cast<const DexFile::MapList*>(begin_ + 289d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe header_->map_off_); 290d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe // Check that map list content is available. 291d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckListSize(map, 1, sizeof(DexFile::MapList), "maplist content")) { 292d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe return false; 293d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe } 294d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe 29510037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MapItem* item = map->list_; 29610037c866b04550fc5461058c398c2e3e509381ajeffhao 29710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = map->size_; 29810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_offset = 0; 29910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t data_item_count = 0; 30010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t data_items_left = header_->data_size_; 30110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t used_bits = 0; 30210037c866b04550fc5461058c398c2e3e509381ajeffhao 30310037c866b04550fc5461058c398c2e3e509381ajeffhao // Sanity check the size of the map list. 30410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(item, count, sizeof(DexFile::MapItem), "map size")) { 30510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 30610037c866b04550fc5461058c398c2e3e509381ajeffhao } 30710037c866b04550fc5461058c398c2e3e509381ajeffhao 30810037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the items listed in the map. 30910037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < count; i++) { 3108d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_offset >= item->offset_ && i != 0)) { 3118d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out of order map item: %x then %x", last_offset, item->offset_); 31210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 31310037c866b04550fc5461058c398c2e3e509381ajeffhao } 3148d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(item->offset_ >= header_->file_size_)) { 3158d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map item after end of file: %x, size %x", 3168d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers item->offset_, header_->file_size_); 31710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 31810037c866b04550fc5461058c398c2e3e509381ajeffhao } 31910037c866b04550fc5461058c398c2e3e509381ajeffhao 32010037c866b04550fc5461058c398c2e3e509381ajeffhao if (IsDataSectionType(item->type_)) { 32110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t icount = item->size_; 3228d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(icount > data_items_left)) { 3238d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Too many items in data section: %ud", data_item_count + icount); 32410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 32510037c866b04550fc5461058c398c2e3e509381ajeffhao } 32610037c866b04550fc5461058c398c2e3e509381ajeffhao data_items_left -= icount; 32710037c866b04550fc5461058c398c2e3e509381ajeffhao data_item_count += icount; 32810037c866b04550fc5461058c398c2e3e509381ajeffhao } 32910037c866b04550fc5461058c398c2e3e509381ajeffhao 33010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t bit = MapTypeToBitMask(item->type_); 33110037c866b04550fc5461058c398c2e3e509381ajeffhao 3328d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(bit == 0)) { 3338d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map section type %x", item->type_); 33410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 33510037c866b04550fc5461058c398c2e3e509381ajeffhao } 33610037c866b04550fc5461058c398c2e3e509381ajeffhao 3378d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & bit) != 0)) { 3388d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Duplicate map section of type %x", item->type_); 33910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 34010037c866b04550fc5461058c398c2e3e509381ajeffhao } 34110037c866b04550fc5461058c398c2e3e509381ajeffhao 34210037c866b04550fc5461058c398c2e3e509381ajeffhao used_bits |= bit; 34310037c866b04550fc5461058c398c2e3e509381ajeffhao last_offset = item->offset_; 34410037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 34510037c866b04550fc5461058c398c2e3e509381ajeffhao } 34610037c866b04550fc5461058c398c2e3e509381ajeffhao 34710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check for missing sections in the map. 3488d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeHeaderItem)) == 0)) { 3498d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing header entry"); 35010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 35110037c866b04550fc5461058c398c2e3e509381ajeffhao } 3528d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeMapList)) == 0)) { 3538d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing map_list entry"); 35410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 35510037c866b04550fc5461058c398c2e3e509381ajeffhao } 3568d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeStringIdItem)) == 0 && 3578d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->string_ids_off_ != 0) || (header_->string_ids_size_ != 0)))) { 3588d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing string_ids entry"); 35910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 36010037c866b04550fc5461058c398c2e3e509381ajeffhao } 3618d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeTypeIdItem)) == 0 && 3628d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->type_ids_off_ != 0) || (header_->type_ids_size_ != 0)))) { 3638d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing type_ids entry"); 36410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 36510037c866b04550fc5461058c398c2e3e509381ajeffhao } 3668d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeProtoIdItem)) == 0 && 3678d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->proto_ids_off_ != 0) || (header_->proto_ids_size_ != 0)))) { 3688d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing proto_ids entry"); 36910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 37010037c866b04550fc5461058c398c2e3e509381ajeffhao } 3718d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeFieldIdItem)) == 0 && 3728d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->field_ids_off_ != 0) || (header_->field_ids_size_ != 0)))) { 3738d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing field_ids entry"); 37410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 37510037c866b04550fc5461058c398c2e3e509381ajeffhao } 3768d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeMethodIdItem)) == 0 && 3778d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->method_ids_off_ != 0) || (header_->method_ids_size_ != 0)))) { 3788d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing method_ids entry"); 37910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 38010037c866b04550fc5461058c398c2e3e509381ajeffhao } 3818d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeClassDefItem)) == 0 && 3828d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->class_defs_off_ != 0) || (header_->class_defs_size_ != 0)))) { 3838d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing class_defs entry"); 38410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 38510037c866b04550fc5461058c398c2e3e509381ajeffhao } 38610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 38710037c866b04550fc5461058c398c2e3e509381ajeffhao} 38810037c866b04550fc5461058c398c2e3e509381ajeffhao 38910037c866b04550fc5461058c398c2e3e509381ajeffhaouint32_t DexFileVerifier::ReadUnsignedLittleEndian(uint32_t size) { 39010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t result = 0; 39113735955f39b3b304c37d2b2840663c131262c18Ian Rogers if (LIKELY(CheckListSize(ptr_, size, sizeof(uint8_t), "encoded_value"))) { 3928d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers for (uint32_t i = 0; i < size; i++) { 3938d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers result |= ((uint32_t) *(ptr_++)) << (i * 8); 3948d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } 39510037c866b04550fc5461058c398c2e3e509381ajeffhao } 39610037c866b04550fc5461058c398c2e3e509381ajeffhao return result; 39710037c866b04550fc5461058c398c2e3e509381ajeffhao} 39810037c866b04550fc5461058c398c2e3e509381ajeffhao 39910037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckAndGetHandlerOffsets(const DexFile::CodeItem* code_item, 4008d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers uint32_t* handler_offsets, uint32_t handlers_size) { 40113735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* handlers_base = DexFile::GetCatchHandlerData(*code_item, 0); 40210037c866b04550fc5461058c398c2e3e509381ajeffhao 40310037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < handlers_size; i++) { 40410037c866b04550fc5461058c398c2e3e509381ajeffhao bool catch_all; 4058a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t offset = ptr_ - handlers_base; 40610037c866b04550fc5461058c398c2e3e509381ajeffhao int32_t size = DecodeSignedLeb128(&ptr_); 40710037c866b04550fc5461058c398c2e3e509381ajeffhao 4088d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((size < -65536) || (size > 65536))) { 4098d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid exception handler size: %d", size); 41010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 41110037c866b04550fc5461058c398c2e3e509381ajeffhao } 41210037c866b04550fc5461058c398c2e3e509381ajeffhao 41310037c866b04550fc5461058c398c2e3e509381ajeffhao if (size <= 0) { 41410037c866b04550fc5461058c398c2e3e509381ajeffhao catch_all = true; 41510037c866b04550fc5461058c398c2e3e509381ajeffhao size = -size; 41610037c866b04550fc5461058c398c2e3e509381ajeffhao } else { 41710037c866b04550fc5461058c398c2e3e509381ajeffhao catch_all = false; 41810037c866b04550fc5461058c398c2e3e509381ajeffhao } 41910037c866b04550fc5461058c398c2e3e509381ajeffhao 4208a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers handler_offsets[i] = static_cast<uint32_t>(offset); 42110037c866b04550fc5461058c398c2e3e509381ajeffhao 42210037c866b04550fc5461058c398c2e3e509381ajeffhao while (size-- > 0) { 42310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t type_idx = DecodeUnsignedLeb128(&ptr_); 42410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(type_idx, header_->type_ids_size_, "handler type_idx")) { 42510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 42610037c866b04550fc5461058c398c2e3e509381ajeffhao } 42710037c866b04550fc5461058c398c2e3e509381ajeffhao 42810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t addr = DecodeUnsignedLeb128(&ptr_); 4298d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(addr >= code_item->insns_size_in_code_units_)) { 4308d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid handler addr: %x", addr); 43110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 43210037c866b04550fc5461058c398c2e3e509381ajeffhao } 43310037c866b04550fc5461058c398c2e3e509381ajeffhao } 43410037c866b04550fc5461058c398c2e3e509381ajeffhao 43510037c866b04550fc5461058c398c2e3e509381ajeffhao if (catch_all) { 43610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t addr = DecodeUnsignedLeb128(&ptr_); 4378d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(addr >= code_item->insns_size_in_code_units_)) { 4388d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid handler catch_all_addr: %x", addr); 43910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 44010037c866b04550fc5461058c398c2e3e509381ajeffhao } 44110037c866b04550fc5461058c398c2e3e509381ajeffhao } 44210037c866b04550fc5461058c398c2e3e509381ajeffhao } 44310037c866b04550fc5461058c398c2e3e509381ajeffhao 44410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 44510037c866b04550fc5461058c398c2e3e509381ajeffhao} 44610037c866b04550fc5461058c398c2e3e509381ajeffhao 44710037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckClassDataItemField(uint32_t idx, uint32_t access_flags, 4488d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers bool expect_static) { 44910037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->field_ids_size_, "class_data_item field_idx")) { 45010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 45110037c866b04550fc5461058c398c2e3e509381ajeffhao } 45210037c866b04550fc5461058c398c2e3e509381ajeffhao 45310037c866b04550fc5461058c398c2e3e509381ajeffhao bool is_static = (access_flags & kAccStatic) != 0; 4548d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(is_static != expect_static)) { 4558d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Static/instance field not in expected list"); 45610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 45710037c866b04550fc5461058c398c2e3e509381ajeffhao } 45810037c866b04550fc5461058c398c2e3e509381ajeffhao 4595182932cf6704b53e957f7b4be021fe505a55e22Andreas Gampe if (UNLIKELY((access_flags & ~kAccJavaFlagsMask) != 0)) { 4608d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad class_data_item field access_flags %x", access_flags); 46110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 46210037c866b04550fc5461058c398c2e3e509381ajeffhao } 46310037c866b04550fc5461058c398c2e3e509381ajeffhao 46410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 46510037c866b04550fc5461058c398c2e3e509381ajeffhao} 46610037c866b04550fc5461058c398c2e3e509381ajeffhao 46710037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckClassDataItemMethod(uint32_t idx, uint32_t access_flags, 468a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao uint32_t code_offset, 469a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao std::unordered_set<uint32_t>& direct_method_indexes, 470a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao bool expect_direct) { 47110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->method_ids_size_, "class_data_item method_idx")) { 47210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 47310037c866b04550fc5461058c398c2e3e509381ajeffhao } 47410037c866b04550fc5461058c398c2e3e509381ajeffhao 47510037c866b04550fc5461058c398c2e3e509381ajeffhao bool is_direct = (access_flags & (kAccStatic | kAccPrivate | kAccConstructor)) != 0; 47610037c866b04550fc5461058c398c2e3e509381ajeffhao bool expect_code = (access_flags & (kAccNative | kAccAbstract)) == 0; 47710037c866b04550fc5461058c398c2e3e509381ajeffhao bool is_synchronized = (access_flags & kAccSynchronized) != 0; 47810037c866b04550fc5461058c398c2e3e509381ajeffhao bool allow_synchronized = (access_flags & kAccNative) != 0; 47910037c866b04550fc5461058c398c2e3e509381ajeffhao 4808d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(is_direct != expect_direct)) { 4818d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Direct/virtual method not in expected list"); 48210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 48310037c866b04550fc5461058c398c2e3e509381ajeffhao } 48410037c866b04550fc5461058c398c2e3e509381ajeffhao 485a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao if (expect_direct) { 486a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao direct_method_indexes.insert(idx); 487a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao } else if (direct_method_indexes.find(idx) != direct_method_indexes.end()) { 488a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao ErrorStringPrintf("Found virtual method with same index as direct method: %d", idx); 489a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao return false; 490a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao } 491a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao 4925182932cf6704b53e957f7b4be021fe505a55e22Andreas Gampe constexpr uint32_t access_method_mask = kAccJavaFlagsMask | kAccConstructor | 4935182932cf6704b53e957f7b4be021fe505a55e22Andreas Gampe kAccDeclaredSynchronized; 4948d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(((access_flags & ~access_method_mask) != 0) || 4958d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers (is_synchronized && !allow_synchronized))) { 4968d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad class_data_item method access_flags %x", access_flags); 49710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 49810037c866b04550fc5461058c398c2e3e509381ajeffhao } 49910037c866b04550fc5461058c398c2e3e509381ajeffhao 5008d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(expect_code && (code_offset == 0))) { 5018d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unexpected zero value for class_data_item method code_off with access " 5028d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers "flags %x", access_flags); 50310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 5048d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } else if (UNLIKELY(!expect_code && (code_offset != 0))) { 5058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unexpected non-zero value %x for class_data_item method code_off" 5068d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers " with access flags %x", code_offset, access_flags); 50710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 50810037c866b04550fc5461058c398c2e3e509381ajeffhao } 50910037c866b04550fc5461058c398c2e3e509381ajeffhao 51010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 51110037c866b04550fc5461058c398c2e3e509381ajeffhao} 51210037c866b04550fc5461058c398c2e3e509381ajeffhao 5138a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckPadding(size_t offset, uint32_t aligned_offset) { 51410037c866b04550fc5461058c398c2e3e509381ajeffhao if (offset < aligned_offset) { 51513735955f39b3b304c37d2b2840663c131262c18Ian Rogers if (!CheckListSize(begin_ + offset, aligned_offset - offset, sizeof(uint8_t), "section")) { 51610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 51710037c866b04550fc5461058c398c2e3e509381ajeffhao } 51810037c866b04550fc5461058c398c2e3e509381ajeffhao while (offset < aligned_offset) { 5198d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(*ptr_ != '\0')) { 5208a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Non-zero padding %x before section start at %zx", *ptr_, offset); 52110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 52210037c866b04550fc5461058c398c2e3e509381ajeffhao } 52310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_++; 52410037c866b04550fc5461058c398c2e3e509381ajeffhao offset++; 52510037c866b04550fc5461058c398c2e3e509381ajeffhao } 52610037c866b04550fc5461058c398c2e3e509381ajeffhao } 52710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 52810037c866b04550fc5461058c398c2e3e509381ajeffhao} 52910037c866b04550fc5461058c398c2e3e509381ajeffhao 53010037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckEncodedValue() { 53113735955f39b3b304c37d2b2840663c131262c18Ian Rogers if (!CheckListSize(ptr_, 1, sizeof(uint8_t), "encoded_value header")) { 53210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 53310037c866b04550fc5461058c398c2e3e509381ajeffhao } 53410037c866b04550fc5461058c398c2e3e509381ajeffhao 53510037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t header_byte = *(ptr_++); 53610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t value_type = header_byte & DexFile::kDexAnnotationValueTypeMask; 53710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t value_arg = header_byte >> DexFile::kDexAnnotationValueArgShift; 53810037c866b04550fc5461058c398c2e3e509381ajeffhao 53910037c866b04550fc5461058c398c2e3e509381ajeffhao switch (value_type) { 54010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationByte: 5418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 5428d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value byte size %x", value_arg); 54310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 54410037c866b04550fc5461058c398c2e3e509381ajeffhao } 54510037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_++; 54610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 54710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationShort: 54810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationChar: 5498d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 1)) { 5508d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value char/short size %x", value_arg); 55110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 55210037c866b04550fc5461058c398c2e3e509381ajeffhao } 55310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += value_arg + 1; 55410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 55510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationInt: 55610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationFloat: 5578d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 5588d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value int/float size %x", value_arg); 55910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 56010037c866b04550fc5461058c398c2e3e509381ajeffhao } 56110037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += value_arg + 1; 56210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 56310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationLong: 56410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationDouble: 56510037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += value_arg + 1; 56610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 56710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationString: { 5688d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 5698d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value string size %x", value_arg); 57010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 57110037c866b04550fc5461058c398c2e3e509381ajeffhao } 57210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 57310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->string_ids_size_, "encoded_value string")) { 57410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 57510037c866b04550fc5461058c398c2e3e509381ajeffhao } 57610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 57710037c866b04550fc5461058c398c2e3e509381ajeffhao } 57810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationType: { 5798d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 5808d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value type size %x", value_arg); 58110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 58210037c866b04550fc5461058c398c2e3e509381ajeffhao } 58310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 58410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->type_ids_size_, "encoded_value type")) { 58510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 58610037c866b04550fc5461058c398c2e3e509381ajeffhao } 58710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 58810037c866b04550fc5461058c398c2e3e509381ajeffhao } 58910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationField: 59010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationEnum: { 5918d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 5928d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value field/enum size %x", value_arg); 59310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 59410037c866b04550fc5461058c398c2e3e509381ajeffhao } 59510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 59610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->field_ids_size_, "encoded_value field")) { 59710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 59810037c866b04550fc5461058c398c2e3e509381ajeffhao } 59910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 60010037c866b04550fc5461058c398c2e3e509381ajeffhao } 60110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationMethod: { 6028d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 6038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value method size %x", value_arg); 60410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 60510037c866b04550fc5461058c398c2e3e509381ajeffhao } 60610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 60710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->method_ids_size_, "encoded_value method")) { 60810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 60910037c866b04550fc5461058c398c2e3e509381ajeffhao } 61010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 61110037c866b04550fc5461058c398c2e3e509381ajeffhao } 61210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationArray: 6138d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 6148d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value array value_arg %x", value_arg); 61510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 61610037c866b04550fc5461058c398c2e3e509381ajeffhao } 61710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedArray()) { 61810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 61910037c866b04550fc5461058c398c2e3e509381ajeffhao } 62010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 62110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationAnnotation: 6228d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 6238d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value annotation value_arg %x", value_arg); 62410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 62510037c866b04550fc5461058c398c2e3e509381ajeffhao } 62610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedAnnotation()) { 62710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 62810037c866b04550fc5461058c398c2e3e509381ajeffhao } 62910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 63010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationNull: 6318d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 6328d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value null value_arg %x", value_arg); 63310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 63410037c866b04550fc5461058c398c2e3e509381ajeffhao } 63510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 63610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationBoolean: 6378d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 1)) { 6388d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value boolean size %x", value_arg); 63910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 64010037c866b04550fc5461058c398c2e3e509381ajeffhao } 64110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 64210037c866b04550fc5461058c398c2e3e509381ajeffhao default: 6438d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bogus encoded_value value_type %x", value_type); 64410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 64510037c866b04550fc5461058c398c2e3e509381ajeffhao } 64610037c866b04550fc5461058c398c2e3e509381ajeffhao 64710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 64810037c866b04550fc5461058c398c2e3e509381ajeffhao} 64910037c866b04550fc5461058c398c2e3e509381ajeffhao 65010037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckEncodedArray() { 65110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = DecodeUnsignedLeb128(&ptr_); 65210037c866b04550fc5461058c398c2e3e509381ajeffhao 65310037c866b04550fc5461058c398c2e3e509381ajeffhao while (size--) { 65410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedValue()) { 6558d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers failure_reason_ = StringPrintf("Bad encoded_array value: %s", failure_reason_.c_str()); 65610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 65710037c866b04550fc5461058c398c2e3e509381ajeffhao } 65810037c866b04550fc5461058c398c2e3e509381ajeffhao } 65910037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 66010037c866b04550fc5461058c398c2e3e509381ajeffhao} 66110037c866b04550fc5461058c398c2e3e509381ajeffhao 66210037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckEncodedAnnotation() { 66310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = DecodeUnsignedLeb128(&ptr_); 66410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->type_ids_size_, "encoded_annotation type_idx")) { 66510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 66610037c866b04550fc5461058c398c2e3e509381ajeffhao } 66710037c866b04550fc5461058c398c2e3e509381ajeffhao 66810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = DecodeUnsignedLeb128(&ptr_); 66910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_idx = 0; 67010037c866b04550fc5461058c398c2e3e509381ajeffhao 67110037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < size; i++) { 67210037c866b04550fc5461058c398c2e3e509381ajeffhao idx = DecodeUnsignedLeb128(&ptr_); 67310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->string_ids_size_, "annotation_element name_idx")) { 67410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 67510037c866b04550fc5461058c398c2e3e509381ajeffhao } 67610037c866b04550fc5461058c398c2e3e509381ajeffhao 6778d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= idx && i != 0)) { 6788d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order annotation_element name_idx: %x then %x", 6798d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers last_idx, idx); 68010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 68110037c866b04550fc5461058c398c2e3e509381ajeffhao } 68210037c866b04550fc5461058c398c2e3e509381ajeffhao 68310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedValue()) { 68410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 68510037c866b04550fc5461058c398c2e3e509381ajeffhao } 68610037c866b04550fc5461058c398c2e3e509381ajeffhao 68710037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = idx; 68810037c866b04550fc5461058c398c2e3e509381ajeffhao } 68910037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 69010037c866b04550fc5461058c398c2e3e509381ajeffhao} 69110037c866b04550fc5461058c398c2e3e509381ajeffhao 69210037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraClassDataItem() { 69310037c866b04550fc5461058c398c2e3e509381ajeffhao ClassDataItemIterator it(*dex_file_, ptr_); 694a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao std::unordered_set<uint32_t> direct_method_indexes; 69510037c866b04550fc5461058c398c2e3e509381ajeffhao 6965182932cf6704b53e957f7b4be021fe505a55e22Andreas Gampe // These calls use the raw access flags to check whether the whole dex field is valid. 697ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao uint32_t prev_index = 0; 69810037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextStaticField(); it.Next()) { 699ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao uint32_t curr_index = it.GetMemberIndex(); 700ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao if (curr_index < prev_index) { 701ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao ErrorStringPrintf("out-of-order static field indexes %d and %d", prev_index, curr_index); 702ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao return false; 703ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao } 704ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao prev_index = curr_index; 705ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao if (!CheckClassDataItemField(curr_index, it.GetRawMemberAccessFlags(), true)) { 70610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 70710037c866b04550fc5461058c398c2e3e509381ajeffhao } 70810037c866b04550fc5461058c398c2e3e509381ajeffhao } 709ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao prev_index = 0; 71010037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextInstanceField(); it.Next()) { 711ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao uint32_t curr_index = it.GetMemberIndex(); 712ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao if (curr_index < prev_index) { 713ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao ErrorStringPrintf("out-of-order instance field indexes %d and %d", prev_index, curr_index); 714ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao return false; 715ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao } 716ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao prev_index = curr_index; 717ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao if (!CheckClassDataItemField(curr_index, it.GetRawMemberAccessFlags(), false)) { 71810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 71910037c866b04550fc5461058c398c2e3e509381ajeffhao } 72010037c866b04550fc5461058c398c2e3e509381ajeffhao } 721ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao prev_index = 0; 72210037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextDirectMethod(); it.Next()) { 723ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao uint32_t curr_index = it.GetMemberIndex(); 724ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao if (curr_index < prev_index) { 725ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao ErrorStringPrintf("out-of-order direct method indexes %d and %d", prev_index, curr_index); 726ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao return false; 727ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao } 728ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao prev_index = curr_index; 729ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao if (!CheckClassDataItemMethod(curr_index, it.GetRawMemberAccessFlags(), 730a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao it.GetMethodCodeItemOffset(), direct_method_indexes, true)) { 73110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 73210037c866b04550fc5461058c398c2e3e509381ajeffhao } 73310037c866b04550fc5461058c398c2e3e509381ajeffhao } 734ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao prev_index = 0; 73510037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextVirtualMethod(); it.Next()) { 736ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao uint32_t curr_index = it.GetMemberIndex(); 737ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao if (curr_index < prev_index) { 738ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao ErrorStringPrintf("out-of-order virtual method indexes %d and %d", prev_index, curr_index); 739ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao return false; 740ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao } 741ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao prev_index = curr_index; 742ec96923620cb6f8a8f8205d89ea30f147e76e7faJeff Hao if (!CheckClassDataItemMethod(curr_index, it.GetRawMemberAccessFlags(), 743a574b0e4772e57134538c3c098d7538d957edc90Jeff Hao it.GetMethodCodeItemOffset(), direct_method_indexes, false)) { 74410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 74510037c866b04550fc5461058c398c2e3e509381ajeffhao } 74610037c866b04550fc5461058c398c2e3e509381ajeffhao } 74710037c866b04550fc5461058c398c2e3e509381ajeffhao 74810037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = it.EndDataPointer(); 74910037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 75010037c866b04550fc5461058c398c2e3e509381ajeffhao} 75110037c866b04550fc5461058c398c2e3e509381ajeffhao 75210037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraCodeItem() { 75310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::CodeItem* code_item = reinterpret_cast<const DexFile::CodeItem*>(ptr_); 75450d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(code_item, 1, sizeof(DexFile::CodeItem), "code")) { 75510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 75610037c866b04550fc5461058c398c2e3e509381ajeffhao } 75710037c866b04550fc5461058c398c2e3e509381ajeffhao 7588d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(code_item->ins_size_ > code_item->registers_size_)) { 7598d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("ins_size (%ud) > registers_size (%ud)", 7608d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers code_item->ins_size_, code_item->registers_size_); 76110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 76210037c866b04550fc5461058c398c2e3e509381ajeffhao } 76310037c866b04550fc5461058c398c2e3e509381ajeffhao 7648d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((code_item->outs_size_ > 5) && 7658d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers (code_item->outs_size_ > code_item->registers_size_))) { 76610037c866b04550fc5461058c398c2e3e509381ajeffhao /* 76710037c866b04550fc5461058c398c2e3e509381ajeffhao * outs_size can be up to 5, even if registers_size is smaller, since the 76810037c866b04550fc5461058c398c2e3e509381ajeffhao * short forms of method invocation allow repetitions of a register multiple 76910037c866b04550fc5461058c398c2e3e509381ajeffhao * times within a single parameter list. However, longer parameter lists 77010037c866b04550fc5461058c398c2e3e509381ajeffhao * need to be represented in-order in the register file. 77110037c866b04550fc5461058c398c2e3e509381ajeffhao */ 7728d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("outs_size (%ud) > registers_size (%ud)", 7738d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers code_item->outs_size_, code_item->registers_size_); 77410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 77510037c866b04550fc5461058c398c2e3e509381ajeffhao } 77610037c866b04550fc5461058c398c2e3e509381ajeffhao 77710037c866b04550fc5461058c398c2e3e509381ajeffhao const uint16_t* insns = code_item->insns_; 77810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t insns_size = code_item->insns_size_in_code_units_; 77910037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(insns, insns_size, sizeof(uint16_t), "insns size")) { 78010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 78110037c866b04550fc5461058c398c2e3e509381ajeffhao } 78210037c866b04550fc5461058c398c2e3e509381ajeffhao 78310037c866b04550fc5461058c398c2e3e509381ajeffhao // Grab the end of the insns if there are no try_items. 78410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t try_items_size = code_item->tries_size_; 78510037c866b04550fc5461058c398c2e3e509381ajeffhao if (try_items_size == 0) { 78613735955f39b3b304c37d2b2840663c131262c18Ian Rogers ptr_ = reinterpret_cast<const uint8_t*>(&insns[insns_size]); 78710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 78810037c866b04550fc5461058c398c2e3e509381ajeffhao } 78910037c866b04550fc5461058c398c2e3e509381ajeffhao 79010037c866b04550fc5461058c398c2e3e509381ajeffhao // try_items are 4-byte aligned. Verify the spacer is 0. 7918a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers if (((reinterpret_cast<uintptr_t>(&insns[insns_size]) & 3) != 0) && (insns[insns_size] != 0)) { 7928d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Non-zero padding: %x", insns[insns_size]); 79310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 79410037c866b04550fc5461058c398c2e3e509381ajeffhao } 79510037c866b04550fc5461058c398c2e3e509381ajeffhao 79610037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TryItem* try_items = DexFile::GetTryItems(*code_item, 0); 79710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(try_items, try_items_size, sizeof(DexFile::TryItem), "try_items size")) { 79810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 79910037c866b04550fc5461058c398c2e3e509381ajeffhao } 80010037c866b04550fc5461058c398c2e3e509381ajeffhao 8016a8df53d90e47e3256faf7ff0caed0acf377b99bAnestis Bechtsoudis ptr_ = DexFile::GetCatchHandlerData(*code_item, 0); 8026a8df53d90e47e3256faf7ff0caed0acf377b99bAnestis Bechtsoudis uint32_t handlers_size = DecodeUnsignedLeb128(&ptr_); 8036a8df53d90e47e3256faf7ff0caed0acf377b99bAnestis Bechtsoudis 8048d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((handlers_size == 0) || (handlers_size >= 65536))) { 8058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid handlers_size: %ud", handlers_size); 80610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 80710037c866b04550fc5461058c398c2e3e509381ajeffhao } 80810037c866b04550fc5461058c398c2e3e509381ajeffhao 809700a402244a1a423da4f3ba8032459f4b65fa18fIan Rogers std::unique_ptr<uint32_t[]> handler_offsets(new uint32_t[handlers_size]); 810ee0fa76b2e5d39ad36d1ff144b2d0270df81e606Elliott Hughes if (!CheckAndGetHandlerOffsets(code_item, &handler_offsets[0], handlers_size)) { 81110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 81210037c866b04550fc5461058c398c2e3e509381ajeffhao } 81310037c866b04550fc5461058c398c2e3e509381ajeffhao 81410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_addr = 0; 81510037c866b04550fc5461058c398c2e3e509381ajeffhao while (try_items_size--) { 8168d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(try_items->start_addr_ < last_addr)) { 8178d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of_order try_item with start_addr: %x", try_items->start_addr_); 81810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 81910037c866b04550fc5461058c398c2e3e509381ajeffhao } 82010037c866b04550fc5461058c398c2e3e509381ajeffhao 8218d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(try_items->start_addr_ >= insns_size)) { 8228d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid try_item start_addr: %x", try_items->start_addr_); 82310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 82410037c866b04550fc5461058c398c2e3e509381ajeffhao } 82510037c866b04550fc5461058c398c2e3e509381ajeffhao 82610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t i; 82710037c866b04550fc5461058c398c2e3e509381ajeffhao for (i = 0; i < handlers_size; i++) { 82810037c866b04550fc5461058c398c2e3e509381ajeffhao if (try_items->handler_off_ == handler_offsets[i]) { 82910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 83010037c866b04550fc5461058c398c2e3e509381ajeffhao } 83110037c866b04550fc5461058c398c2e3e509381ajeffhao } 83210037c866b04550fc5461058c398c2e3e509381ajeffhao 8338d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(i == handlers_size)) { 8348d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bogus handler offset: %x", try_items->handler_off_); 83510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 83610037c866b04550fc5461058c398c2e3e509381ajeffhao } 83710037c866b04550fc5461058c398c2e3e509381ajeffhao 83810037c866b04550fc5461058c398c2e3e509381ajeffhao last_addr = try_items->start_addr_ + try_items->insn_count_; 8398d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_addr > insns_size)) { 8408d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid try_item insn_count: %x", try_items->insn_count_); 84110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 84210037c866b04550fc5461058c398c2e3e509381ajeffhao } 84310037c866b04550fc5461058c398c2e3e509381ajeffhao 84410037c866b04550fc5461058c398c2e3e509381ajeffhao try_items++; 84510037c866b04550fc5461058c398c2e3e509381ajeffhao } 84610037c866b04550fc5461058c398c2e3e509381ajeffhao 84710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 84810037c866b04550fc5461058c398c2e3e509381ajeffhao} 84910037c866b04550fc5461058c398c2e3e509381ajeffhao 85010037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraStringDataItem() { 85110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = DecodeUnsignedLeb128(&ptr_); 85213735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* file_end = begin_ + size_; 85310037c866b04550fc5461058c398c2e3e509381ajeffhao 85410037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < size; i++) { 855c647564845429bd709ed3338c13f15063c2f9fd9Brian Carlstrom CHECK_LT(i, size); // b/15014252 Prevents hitting the impossible case below 8568d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(ptr_ >= file_end)) { 8578d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("String data would go beyond end-of-file"); 85810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 85910037c866b04550fc5461058c398c2e3e509381ajeffhao } 86010037c866b04550fc5461058c398c2e3e509381ajeffhao 86110037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte = *(ptr_++); 86210037c866b04550fc5461058c398c2e3e509381ajeffhao 86310037c866b04550fc5461058c398c2e3e509381ajeffhao // Switch on the high 4 bits. 86410037c866b04550fc5461058c398c2e3e509381ajeffhao switch (byte >> 4) { 86510037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x00: 86610037c866b04550fc5461058c398c2e3e509381ajeffhao // Special case of bit pattern 0xxx. 8678d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(byte == 0)) { 868c647564845429bd709ed3338c13f15063c2f9fd9Brian Carlstrom CHECK_LT(i, size); // b/15014252 Actually hit this impossible case with clang 8698d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("String data shorter than indicated utf16_size %x", size); 87010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 87110037c866b04550fc5461058c398c2e3e509381ajeffhao } 87210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 87310037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x01: 87410037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x02: 87510037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x03: 87610037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x04: 87710037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x05: 87810037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x06: 87910037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x07: 88010037c866b04550fc5461058c398c2e3e509381ajeffhao // No extra checks necessary for bit pattern 0xxx. 88110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 88210037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x08: 88310037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x09: 88410037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0a: 88510037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0b: 88610037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0f: 88710037c866b04550fc5461058c398c2e3e509381ajeffhao // Illegal bit patterns 10xx or 1111. 88810037c866b04550fc5461058c398c2e3e509381ajeffhao // Note: 1111 is valid for normal UTF-8, but not here. 8898d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal start byte %x in string data", byte); 89010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 89110037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0c: 89210037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0d: { 89310037c866b04550fc5461058c398c2e3e509381ajeffhao // Bit pattern 110x has an additional byte. 89410037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte2 = *(ptr_++); 8958d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((byte2 & 0xc0) != 0x80)) { 8968d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal continuation byte %x in string data", byte2); 89710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 89810037c866b04550fc5461058c398c2e3e509381ajeffhao } 89910037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t value = ((byte & 0x1f) << 6) | (byte2 & 0x3f); 9008d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((value != 0) && (value < 0x80))) { 9018d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal representation for value %x in string data", value); 90210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 90310037c866b04550fc5461058c398c2e3e509381ajeffhao } 90410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 90510037c866b04550fc5461058c398c2e3e509381ajeffhao } 90610037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0e: { 90710037c866b04550fc5461058c398c2e3e509381ajeffhao // Bit pattern 1110 has 2 additional bytes. 90810037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte2 = *(ptr_++); 9098d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((byte2 & 0xc0) != 0x80)) { 9108d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal continuation byte %x in string data", byte2); 91110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 91210037c866b04550fc5461058c398c2e3e509381ajeffhao } 91310037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte3 = *(ptr_++); 9148d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((byte3 & 0xc0) != 0x80)) { 9158d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal continuation byte %x in string data", byte3); 91610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 91710037c866b04550fc5461058c398c2e3e509381ajeffhao } 91810037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t value = ((byte & 0x0f) << 12) | ((byte2 & 0x3f) << 6) | (byte3 & 0x3f); 9198d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value < 0x800)) { 9208d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal representation for value %x in string data", value); 92110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 92210037c866b04550fc5461058c398c2e3e509381ajeffhao } 92310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 92410037c866b04550fc5461058c398c2e3e509381ajeffhao } 92510037c866b04550fc5461058c398c2e3e509381ajeffhao } 92610037c866b04550fc5461058c398c2e3e509381ajeffhao } 92710037c866b04550fc5461058c398c2e3e509381ajeffhao 9288d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(*(ptr_++) != '\0')) { 9298d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("String longer than indicated size %x", size); 93010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 93110037c866b04550fc5461058c398c2e3e509381ajeffhao } 93210037c866b04550fc5461058c398c2e3e509381ajeffhao 93310037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 93410037c866b04550fc5461058c398c2e3e509381ajeffhao} 93510037c866b04550fc5461058c398c2e3e509381ajeffhao 93610037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraDebugInfoItem() { 93710037c866b04550fc5461058c398c2e3e509381ajeffhao DecodeUnsignedLeb128(&ptr_); 93810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameters_size = DecodeUnsignedLeb128(&ptr_); 9398d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(parameters_size > 65536)) { 9408d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid parameters_size: %x", parameters_size); 94110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 94210037c866b04550fc5461058c398c2e3e509381ajeffhao } 94310037c866b04550fc5461058c398c2e3e509381ajeffhao 94410037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t j = 0; j < parameters_size; j++) { 94510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameter_name = DecodeUnsignedLeb128(&ptr_); 94610037c866b04550fc5461058c398c2e3e509381ajeffhao if (parameter_name != 0) { 94710037c866b04550fc5461058c398c2e3e509381ajeffhao parameter_name--; 94810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(parameter_name, header_->string_ids_size_, "debug_info_item parameter_name")) { 94910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 95010037c866b04550fc5461058c398c2e3e509381ajeffhao } 95110037c866b04550fc5461058c398c2e3e509381ajeffhao } 95210037c866b04550fc5461058c398c2e3e509381ajeffhao } 95310037c866b04550fc5461058c398c2e3e509381ajeffhao 95410037c866b04550fc5461058c398c2e3e509381ajeffhao while (true) { 95510037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t opcode = *(ptr_++); 95610037c866b04550fc5461058c398c2e3e509381ajeffhao switch (opcode) { 95710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_END_SEQUENCE: { 95810037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 95910037c866b04550fc5461058c398c2e3e509381ajeffhao } 96010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_ADVANCE_PC: { 96110037c866b04550fc5461058c398c2e3e509381ajeffhao DecodeUnsignedLeb128(&ptr_); 96210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 96310037c866b04550fc5461058c398c2e3e509381ajeffhao } 96410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_ADVANCE_LINE: { 96510037c866b04550fc5461058c398c2e3e509381ajeffhao DecodeSignedLeb128(&ptr_); 96610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 96710037c866b04550fc5461058c398c2e3e509381ajeffhao } 96810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_START_LOCAL: { 96910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t reg_num = DecodeUnsignedLeb128(&ptr_); 9708d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(reg_num >= 65536)) { 9718d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad reg_num for opcode %x", opcode); 97210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 97310037c866b04550fc5461058c398c2e3e509381ajeffhao } 97410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t name_idx = DecodeUnsignedLeb128(&ptr_); 97510037c866b04550fc5461058c398c2e3e509381ajeffhao if (name_idx != 0) { 97610037c866b04550fc5461058c398c2e3e509381ajeffhao name_idx--; 97710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(name_idx, header_->string_ids_size_, "DBG_START_LOCAL name_idx")) { 97810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 97910037c866b04550fc5461058c398c2e3e509381ajeffhao } 98010037c866b04550fc5461058c398c2e3e509381ajeffhao } 98110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t type_idx = DecodeUnsignedLeb128(&ptr_); 98210037c866b04550fc5461058c398c2e3e509381ajeffhao if (type_idx != 0) { 98310037c866b04550fc5461058c398c2e3e509381ajeffhao type_idx--; 984dd3208d3b2f4b78678a341f38a5cc7761c7fca91Logan Chien if (!CheckIndex(type_idx, header_->type_ids_size_, "DBG_START_LOCAL type_idx")) { 98510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 98610037c866b04550fc5461058c398c2e3e509381ajeffhao } 98710037c866b04550fc5461058c398c2e3e509381ajeffhao } 98810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 98910037c866b04550fc5461058c398c2e3e509381ajeffhao } 99010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_END_LOCAL: 99110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_RESTART_LOCAL: { 99210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t reg_num = DecodeUnsignedLeb128(&ptr_); 9938d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(reg_num >= 65536)) { 9948d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad reg_num for opcode %x", opcode); 99510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 99610037c866b04550fc5461058c398c2e3e509381ajeffhao } 99710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 99810037c866b04550fc5461058c398c2e3e509381ajeffhao } 99910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_START_LOCAL_EXTENDED: { 100010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t reg_num = DecodeUnsignedLeb128(&ptr_); 10018d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(reg_num >= 65536)) { 10028d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad reg_num for opcode %x", opcode); 100310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 100410037c866b04550fc5461058c398c2e3e509381ajeffhao } 100510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t name_idx = DecodeUnsignedLeb128(&ptr_); 100610037c866b04550fc5461058c398c2e3e509381ajeffhao if (name_idx != 0) { 100710037c866b04550fc5461058c398c2e3e509381ajeffhao name_idx--; 100810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(name_idx, header_->string_ids_size_, "DBG_START_LOCAL_EXTENDED name_idx")) { 100910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 101010037c866b04550fc5461058c398c2e3e509381ajeffhao } 101110037c866b04550fc5461058c398c2e3e509381ajeffhao } 101210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t type_idx = DecodeUnsignedLeb128(&ptr_); 101310037c866b04550fc5461058c398c2e3e509381ajeffhao if (type_idx != 0) { 101410037c866b04550fc5461058c398c2e3e509381ajeffhao type_idx--; 1015dd3208d3b2f4b78678a341f38a5cc7761c7fca91Logan Chien if (!CheckIndex(type_idx, header_->type_ids_size_, "DBG_START_LOCAL_EXTENDED type_idx")) { 101610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 101710037c866b04550fc5461058c398c2e3e509381ajeffhao } 101810037c866b04550fc5461058c398c2e3e509381ajeffhao } 101910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t sig_idx = DecodeUnsignedLeb128(&ptr_); 102010037c866b04550fc5461058c398c2e3e509381ajeffhao if (sig_idx != 0) { 102110037c866b04550fc5461058c398c2e3e509381ajeffhao sig_idx--; 102210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(sig_idx, header_->string_ids_size_, "DBG_START_LOCAL_EXTENDED sig_idx")) { 102310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 102410037c866b04550fc5461058c398c2e3e509381ajeffhao } 102510037c866b04550fc5461058c398c2e3e509381ajeffhao } 102610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 102710037c866b04550fc5461058c398c2e3e509381ajeffhao } 102810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_SET_FILE: { 102910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t name_idx = DecodeUnsignedLeb128(&ptr_); 103010037c866b04550fc5461058c398c2e3e509381ajeffhao if (name_idx != 0) { 103110037c866b04550fc5461058c398c2e3e509381ajeffhao name_idx--; 103210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(name_idx, header_->string_ids_size_, "DBG_SET_FILE name_idx")) { 103310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 103410037c866b04550fc5461058c398c2e3e509381ajeffhao } 103510037c866b04550fc5461058c398c2e3e509381ajeffhao } 103610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 103710037c866b04550fc5461058c398c2e3e509381ajeffhao } 103810037c866b04550fc5461058c398c2e3e509381ajeffhao } 103910037c866b04550fc5461058c398c2e3e509381ajeffhao } 104010037c866b04550fc5461058c398c2e3e509381ajeffhao} 104110037c866b04550fc5461058c398c2e3e509381ajeffhao 104210037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraAnnotationItem() { 104313735955f39b3b304c37d2b2840663c131262c18Ian Rogers if (!CheckListSize(ptr_, 1, sizeof(uint8_t), "annotation visibility")) { 104410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 104510037c866b04550fc5461058c398c2e3e509381ajeffhao } 104610037c866b04550fc5461058c398c2e3e509381ajeffhao 104710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check visibility 104810037c866b04550fc5461058c398c2e3e509381ajeffhao switch (*(ptr_++)) { 104910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexVisibilityBuild: 105010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexVisibilityRuntime: 105110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexVisibilitySystem: 105210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 105310037c866b04550fc5461058c398c2e3e509381ajeffhao default: 10548d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad annotation visibility: %x", *ptr_); 105510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 105610037c866b04550fc5461058c398c2e3e509381ajeffhao } 105710037c866b04550fc5461058c398c2e3e509381ajeffhao 105810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedAnnotation()) { 105910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 106010037c866b04550fc5461058c398c2e3e509381ajeffhao } 106110037c866b04550fc5461058c398c2e3e509381ajeffhao 106210037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 106310037c866b04550fc5461058c398c2e3e509381ajeffhao} 106410037c866b04550fc5461058c398c2e3e509381ajeffhao 106510037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraAnnotationsDirectoryItem() { 106610037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationsDirectoryItem* item = 106710037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationsDirectoryItem*>(ptr_); 106850d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(item, 1, sizeof(DexFile::AnnotationsDirectoryItem), "annotations_directory")) { 106910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 107010037c866b04550fc5461058c398c2e3e509381ajeffhao } 107110037c866b04550fc5461058c398c2e3e509381ajeffhao 107210037c866b04550fc5461058c398c2e3e509381ajeffhao // Field annotations follow immediately after the annotations directory. 107310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldAnnotationsItem* field_item = 107410037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::FieldAnnotationsItem*>(item + 1); 107510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t field_count = item->fields_size_; 107610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(field_item, field_count, sizeof(DexFile::FieldAnnotationsItem), "field_annotations list")) { 107710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 107810037c866b04550fc5461058c398c2e3e509381ajeffhao } 107910037c866b04550fc5461058c398c2e3e509381ajeffhao 108010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_idx = 0; 108110037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < field_count; i++) { 10828d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= field_item->field_idx_ && i != 0)) { 10838d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_idx for annotation: %x then %x", last_idx, field_item->field_idx_); 108410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 108510037c866b04550fc5461058c398c2e3e509381ajeffhao } 108610037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = field_item->field_idx_; 108710037c866b04550fc5461058c398c2e3e509381ajeffhao field_item++; 108810037c866b04550fc5461058c398c2e3e509381ajeffhao } 108910037c866b04550fc5461058c398c2e3e509381ajeffhao 109010037c866b04550fc5461058c398c2e3e509381ajeffhao // Method annotations follow immediately after field annotations. 109110037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodAnnotationsItem* method_item = 109210037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::MethodAnnotationsItem*>(field_item); 109310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t method_count = item->methods_size_; 109410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(method_item, method_count, sizeof(DexFile::MethodAnnotationsItem), "method_annotations list")) { 109510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 109610037c866b04550fc5461058c398c2e3e509381ajeffhao } 109710037c866b04550fc5461058c398c2e3e509381ajeffhao 109810037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = 0; 109910037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < method_count; i++) { 11008d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= method_item->method_idx_ && i != 0)) { 11018d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_idx for annotation: %x then %x", 11028d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers last_idx, method_item->method_idx_); 110310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 110410037c866b04550fc5461058c398c2e3e509381ajeffhao } 110510037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = method_item->method_idx_; 110610037c866b04550fc5461058c398c2e3e509381ajeffhao method_item++; 110710037c866b04550fc5461058c398c2e3e509381ajeffhao } 110810037c866b04550fc5461058c398c2e3e509381ajeffhao 110910037c866b04550fc5461058c398c2e3e509381ajeffhao // Parameter annotations follow immediately after method annotations. 111010037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ParameterAnnotationsItem* parameter_item = 111110037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::ParameterAnnotationsItem*>(method_item); 111210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameter_count = item->parameters_size_; 11132b87ddf36abff711fa2233c49bffc7ceb03b15d7Dragos Sbirlea if (!CheckListSize(parameter_item, parameter_count, sizeof(DexFile::ParameterAnnotationsItem), 11148d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers "parameter_annotations list")) { 111510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 111610037c866b04550fc5461058c398c2e3e509381ajeffhao } 111710037c866b04550fc5461058c398c2e3e509381ajeffhao 111810037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = 0; 111910037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < parameter_count; i++) { 11208d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= parameter_item->method_idx_ && i != 0)) { 11218d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_idx for annotation: %x then %x", 11228d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers last_idx, parameter_item->method_idx_); 112310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 112410037c866b04550fc5461058c398c2e3e509381ajeffhao } 112510037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = parameter_item->method_idx_; 112610037c866b04550fc5461058c398c2e3e509381ajeffhao parameter_item++; 112710037c866b04550fc5461058c398c2e3e509381ajeffhao } 112810037c866b04550fc5461058c398c2e3e509381ajeffhao 112910037c866b04550fc5461058c398c2e3e509381ajeffhao // Return a pointer to the end of the annotations. 113013735955f39b3b304c37d2b2840663c131262c18Ian Rogers ptr_ = reinterpret_cast<const uint8_t*>(parameter_item); 113110037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 113210037c866b04550fc5461058c398c2e3e509381ajeffhao} 113310037c866b04550fc5461058c398c2e3e509381ajeffhao 1134b061cc1dc41a976f5a620c19498d4b2f4d1675dbAndreas Gampebool DexFileVerifier::CheckIntraSectionIterate(size_t offset, uint32_t section_count, 1135b061cc1dc41a976f5a620c19498d4b2f4d1675dbAndreas Gampe uint16_t type) { 113610037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the right alignment mask for the type of section. 11378a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t alignment_mask; 113810037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 113910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 114010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: 114110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: 114210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: 114310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: 114410037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint8_t) - 1; 114510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 114610037c866b04550fc5461058c398c2e3e509381ajeffhao default: 114710037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint32_t) - 1; 114810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 114910037c866b04550fc5461058c398c2e3e509381ajeffhao } 115010037c866b04550fc5461058c398c2e3e509381ajeffhao 115110037c866b04550fc5461058c398c2e3e509381ajeffhao // Iterate through the items in the section. 1152b061cc1dc41a976f5a620c19498d4b2f4d1675dbAndreas Gampe for (uint32_t i = 0; i < section_count; i++) { 11538a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t aligned_offset = (offset + alignment_mask) & ~alignment_mask; 115410037c866b04550fc5461058c398c2e3e509381ajeffhao 115510037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the padding between items. 115610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPadding(offset, aligned_offset)) { 115710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 115810037c866b04550fc5461058c398c2e3e509381ajeffhao } 115910037c866b04550fc5461058c398c2e3e509381ajeffhao 116010037c866b04550fc5461058c398c2e3e509381ajeffhao // Check depending on the section type. 116110037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 116210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: { 116350d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::StringId), "string_ids")) { 116410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 116510037c866b04550fc5461058c398c2e3e509381ajeffhao } 116610037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::StringId); 116710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 116810037c866b04550fc5461058c398c2e3e509381ajeffhao } 116910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: { 117050d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::TypeId), "type_ids")) { 117110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 117210037c866b04550fc5461058c398c2e3e509381ajeffhao } 117310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::TypeId); 117410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 117510037c866b04550fc5461058c398c2e3e509381ajeffhao } 117610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: { 117750d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::ProtoId), "proto_ids")) { 117810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 117910037c866b04550fc5461058c398c2e3e509381ajeffhao } 118010037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ProtoId); 118110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 118210037c866b04550fc5461058c398c2e3e509381ajeffhao } 118310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: { 118450d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::FieldId), "field_ids")) { 118510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 118610037c866b04550fc5461058c398c2e3e509381ajeffhao } 118710037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::FieldId); 118810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 118910037c866b04550fc5461058c398c2e3e509381ajeffhao } 119010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: { 119150d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::MethodId), "method_ids")) { 119210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 119310037c866b04550fc5461058c398c2e3e509381ajeffhao } 119410037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::MethodId); 119510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 119610037c866b04550fc5461058c398c2e3e509381ajeffhao } 119710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: { 119850d1bc198b2e347d60df74c3b0c452e1f929dd2fAndreas Gampe if (!CheckListSize(ptr_, 1, sizeof(DexFile::ClassDef), "class_defs")) { 119910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 120010037c866b04550fc5461058c398c2e3e509381ajeffhao } 120110037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ClassDef); 120210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 120310037c866b04550fc5461058c398c2e3e509381ajeffhao } 120410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: { 1205d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckList(sizeof(DexFile::TypeItem), "type_list", &ptr_)) { 120610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 120710037c866b04550fc5461058c398c2e3e509381ajeffhao } 120810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 120910037c866b04550fc5461058c398c2e3e509381ajeffhao } 121010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: { 1211d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckList(sizeof(DexFile::AnnotationSetRefItem), "annotation_set_ref_list", &ptr_)) { 121210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 121310037c866b04550fc5461058c398c2e3e509381ajeffhao } 121410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 121510037c866b04550fc5461058c398c2e3e509381ajeffhao } 121610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: { 1217d4ae41fd7a4ed711277c61c0d7fd2a3759458728Andreas Gampe if (!CheckList(sizeof(uint32_t), "annotation_set_item", &ptr_)) { 121810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 121910037c866b04550fc5461058c398c2e3e509381ajeffhao } 122010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 122110037c866b04550fc5461058c398c2e3e509381ajeffhao } 122210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: { 122310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraClassDataItem()) { 122410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 122510037c866b04550fc5461058c398c2e3e509381ajeffhao } 122610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 122710037c866b04550fc5461058c398c2e3e509381ajeffhao } 122810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: { 122910037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraCodeItem()) { 123010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 123110037c866b04550fc5461058c398c2e3e509381ajeffhao } 123210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 123310037c866b04550fc5461058c398c2e3e509381ajeffhao } 123410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: { 123510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraStringDataItem()) { 123610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 123710037c866b04550fc5461058c398c2e3e509381ajeffhao } 123810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 123910037c866b04550fc5461058c398c2e3e509381ajeffhao } 124010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: { 124110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraDebugInfoItem()) { 124210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 124310037c866b04550fc5461058c398c2e3e509381ajeffhao } 124410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 124510037c866b04550fc5461058c398c2e3e509381ajeffhao } 124610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: { 124710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraAnnotationItem()) { 124810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 124910037c866b04550fc5461058c398c2e3e509381ajeffhao } 125010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 125110037c866b04550fc5461058c398c2e3e509381ajeffhao } 125210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: { 125310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedArray()) { 125410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 125510037c866b04550fc5461058c398c2e3e509381ajeffhao } 125610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 125710037c866b04550fc5461058c398c2e3e509381ajeffhao } 125810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: { 125910037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraAnnotationsDirectoryItem()) { 126010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 126110037c866b04550fc5461058c398c2e3e509381ajeffhao } 126210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 126310037c866b04550fc5461058c398c2e3e509381ajeffhao } 126410037c866b04550fc5461058c398c2e3e509381ajeffhao default: 12658d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 126610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 126710037c866b04550fc5461058c398c2e3e509381ajeffhao } 126810037c866b04550fc5461058c398c2e3e509381ajeffhao 126910037c866b04550fc5461058c398c2e3e509381ajeffhao if (IsDataSectionType(type)) { 1270a0e180632411f7fe0edf454e571c42209ee7b540Elliott Hughes offset_to_type_map_.Put(aligned_offset, type); 127110037c866b04550fc5461058c398c2e3e509381ajeffhao } 127210037c866b04550fc5461058c398c2e3e509381ajeffhao 12738a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers aligned_offset = ptr_ - begin_; 12748d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(aligned_offset > size_)) { 12758d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Item %d at ends out of bounds", i); 127610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 127710037c866b04550fc5461058c398c2e3e509381ajeffhao } 127810037c866b04550fc5461058c398c2e3e509381ajeffhao 127910037c866b04550fc5461058c398c2e3e509381ajeffhao offset = aligned_offset; 128010037c866b04550fc5461058c398c2e3e509381ajeffhao } 128110037c866b04550fc5461058c398c2e3e509381ajeffhao 128210037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 128310037c866b04550fc5461058c398c2e3e509381ajeffhao} 128410037c866b04550fc5461058c398c2e3e509381ajeffhao 12858a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckIntraIdSection(size_t offset, uint32_t count, uint16_t type) { 128610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t expected_offset; 128710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t expected_size; 128810037c866b04550fc5461058c398c2e3e509381ajeffhao 128910037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the expected offset and size from the header. 129010037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 129110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 129210037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->string_ids_off_; 129310037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->string_ids_size_; 129410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 129510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 129610037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->type_ids_off_; 129710037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->type_ids_size_; 129810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 129910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 130010037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->proto_ids_off_; 130110037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->proto_ids_size_; 130210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 130310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 130410037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->field_ids_off_; 130510037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->field_ids_size_; 130610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 130710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 130810037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->method_ids_off_; 130910037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->method_ids_size_; 131010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 131110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 131210037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->class_defs_off_; 131310037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->class_defs_size_; 131410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 131510037c866b04550fc5461058c398c2e3e509381ajeffhao default: 13168d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad type for id section: %x", type); 131710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 131810037c866b04550fc5461058c398c2e3e509381ajeffhao } 131910037c866b04550fc5461058c398c2e3e509381ajeffhao 132010037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the offset and size are what were expected from the header. 13218d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(offset != expected_offset)) { 13228a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Bad offset for section: got %zx, expected %x", offset, expected_offset); 132310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 132410037c866b04550fc5461058c398c2e3e509381ajeffhao } 13258d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(count != expected_size)) { 13268d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad size for section: got %x, expected %x", count, expected_size); 132710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 132810037c866b04550fc5461058c398c2e3e509381ajeffhao } 132910037c866b04550fc5461058c398c2e3e509381ajeffhao 133010037c866b04550fc5461058c398c2e3e509381ajeffhao return CheckIntraSectionIterate(offset, count, type); 133110037c866b04550fc5461058c398c2e3e509381ajeffhao} 133210037c866b04550fc5461058c398c2e3e509381ajeffhao 13338a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckIntraDataSection(size_t offset, uint32_t count, uint16_t type) { 13348a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t data_start = header_->data_off_; 13358a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t data_end = data_start + header_->data_size_; 133610037c866b04550fc5461058c398c2e3e509381ajeffhao 133710037c866b04550fc5461058c398c2e3e509381ajeffhao // Sanity check the offset of the section. 13388d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((offset < data_start) || (offset > data_end))) { 13398a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Bad offset for data subsection: %zx", offset); 134010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 134110037c866b04550fc5461058c398c2e3e509381ajeffhao } 134210037c866b04550fc5461058c398c2e3e509381ajeffhao 134310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraSectionIterate(offset, count, type)) { 134410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 134510037c866b04550fc5461058c398c2e3e509381ajeffhao } 134610037c866b04550fc5461058c398c2e3e509381ajeffhao 13478a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t next_offset = ptr_ - begin_; 134810037c866b04550fc5461058c398c2e3e509381ajeffhao if (next_offset > data_end) { 13498a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Out-of-bounds end of data subsection: %zx", next_offset); 135010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 135110037c866b04550fc5461058c398c2e3e509381ajeffhao } 135210037c866b04550fc5461058c398c2e3e509381ajeffhao 135310037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 135410037c866b04550fc5461058c398c2e3e509381ajeffhao} 135510037c866b04550fc5461058c398c2e3e509381ajeffhao 135610037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraSection() { 135730fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers const DexFile::MapList* map = reinterpret_cast<const DexFile::MapList*>(begin_ + header_->map_off_); 135810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MapItem* item = map->list_; 135910037c866b04550fc5461058c398c2e3e509381ajeffhao 136010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = map->size_; 13618a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t offset = 0; 136230fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers ptr_ = begin_; 136310037c866b04550fc5461058c398c2e3e509381ajeffhao 136410037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the items listed in the map. 136510037c866b04550fc5461058c398c2e3e509381ajeffhao while (count--) { 136610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_offset = item->offset_; 136710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_count = item->size_; 136810037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t type = item->type_; 136910037c866b04550fc5461058c398c2e3e509381ajeffhao 137010037c866b04550fc5461058c398c2e3e509381ajeffhao // Check for padding and overlap between items. 137110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPadding(offset, section_offset)) { 137210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 13738d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } else if (UNLIKELY(offset > section_offset)) { 13748a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Section overlap or out-of-order map: %zx, %x", offset, section_offset); 137510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 137610037c866b04550fc5461058c398c2e3e509381ajeffhao } 137710037c866b04550fc5461058c398c2e3e509381ajeffhao 137810037c866b04550fc5461058c398c2e3e509381ajeffhao // Check each item based on its type. 137910037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 138010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: 13818d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_count != 1)) { 13828d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Multiple header items"); 138310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 138410037c866b04550fc5461058c398c2e3e509381ajeffhao } 13858d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_offset != 0)) { 13868d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Header at %x, not at start of file", section_offset); 138710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 138810037c866b04550fc5461058c398c2e3e509381ajeffhao } 138930fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers ptr_ = begin_ + header_->header_size_; 139010037c866b04550fc5461058c398c2e3e509381ajeffhao offset = header_->header_size_; 139110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 139210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 139310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 139410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 139510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 139610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 139710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 139810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraIdSection(section_offset, section_count, type)) { 139910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 140010037c866b04550fc5461058c398c2e3e509381ajeffhao } 14018a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers offset = ptr_ - begin_; 140210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 140310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMapList: 14048d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_count != 1)) { 14058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Multiple map list items"); 140610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 140710037c866b04550fc5461058c398c2e3e509381ajeffhao } 14088d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_offset != header_->map_off_)) { 14098d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map not at header-defined offset: %x, expected %x", 14108d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers section_offset, header_->map_off_); 141110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 141210037c866b04550fc5461058c398c2e3e509381ajeffhao } 141310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(uint32_t) + (map->size_ * sizeof(DexFile::MapItem)); 141410037c866b04550fc5461058c398c2e3e509381ajeffhao offset = section_offset + sizeof(uint32_t) + (map->size_ * sizeof(DexFile::MapItem)); 141510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 141610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: 141710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: 141810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: 141910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 142010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: 142110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: 142210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: 142310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: 142410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: 142510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: 142610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraDataSection(section_offset, section_count, type)) { 142710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 142810037c866b04550fc5461058c398c2e3e509381ajeffhao } 14298a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers offset = ptr_ - begin_; 143010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 143110037c866b04550fc5461058c398c2e3e509381ajeffhao default: 14328d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 143310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 143410037c866b04550fc5461058c398c2e3e509381ajeffhao } 143510037c866b04550fc5461058c398c2e3e509381ajeffhao 143610037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 143710037c866b04550fc5461058c398c2e3e509381ajeffhao } 143810037c866b04550fc5461058c398c2e3e509381ajeffhao 143910037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 144010037c866b04550fc5461058c398c2e3e509381ajeffhao} 144110037c866b04550fc5461058c398c2e3e509381ajeffhao 14428a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckOffsetToTypeMap(size_t offset, uint16_t type) { 144302e25119b15a6f619f17db99f5d05124a5807ff3Mathieu Chartier auto it = offset_to_type_map_.find(offset); 14448d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(it == offset_to_type_map_.end())) { 14458a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("No data map entry found @ %zx; expected %x", offset, type); 144610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 144710037c866b04550fc5461058c398c2e3e509381ajeffhao } 14488d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(it->second != type)) { 14498a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Unexpected data map entry @ %zx; expected %x, found %x", 14508d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers offset, type, it->second); 145110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 145210037c866b04550fc5461058c398c2e3e509381ajeffhao } 145310037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 145410037c866b04550fc5461058c398c2e3e509381ajeffhao} 145510037c866b04550fc5461058c398c2e3e509381ajeffhao 145613735955f39b3b304c37d2b2840663c131262c18Ian Rogersuint16_t DexFileVerifier::FindFirstClassDataDefiner(const uint8_t* ptr, bool* success) { 145710037c866b04550fc5461058c398c2e3e509381ajeffhao ClassDataItemIterator it(*dex_file_, ptr); 14585e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = true; 145910037c866b04550fc5461058c398c2e3e509381ajeffhao 146010037c866b04550fc5461058c398c2e3e509381ajeffhao if (it.HasNextStaticField() || it.HasNextInstanceField()) { 14615e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_FIELD(field, it.GetMemberIndex(), "first_class_data_definer field_id", 14625e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = false; return DexFile::kDexNoIndex16) 1463e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return field->class_idx_; 146410037c866b04550fc5461058c398c2e3e509381ajeffhao } 146510037c866b04550fc5461058c398c2e3e509381ajeffhao 146610037c866b04550fc5461058c398c2e3e509381ajeffhao if (it.HasNextDirectMethod() || it.HasNextVirtualMethod()) { 14675e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_METHOD(method, it.GetMemberIndex(), "first_class_data_definer method_id", 14685e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = false; return DexFile::kDexNoIndex16) 1469e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return method->class_idx_; 147010037c866b04550fc5461058c398c2e3e509381ajeffhao } 147110037c866b04550fc5461058c398c2e3e509381ajeffhao 147210037c866b04550fc5461058c398c2e3e509381ajeffhao return DexFile::kDexNoIndex16; 147310037c866b04550fc5461058c398c2e3e509381ajeffhao} 147410037c866b04550fc5461058c398c2e3e509381ajeffhao 147513735955f39b3b304c37d2b2840663c131262c18Ian Rogersuint16_t DexFileVerifier::FindFirstAnnotationsDirectoryDefiner(const uint8_t* ptr, bool* success) { 147610037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationsDirectoryItem* item = 147710037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationsDirectoryItem*>(ptr); 14785e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = true; 14795e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe 148010037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->fields_size_ != 0) { 148110037c866b04550fc5461058c398c2e3e509381ajeffhao DexFile::FieldAnnotationsItem* field_items = (DexFile::FieldAnnotationsItem*) (item + 1); 14825e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_FIELD(field, field_items[0].field_idx_, "first_annotations_dir_definer field_id", 14835e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = false; return DexFile::kDexNoIndex16) 1484e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return field->class_idx_; 148510037c866b04550fc5461058c398c2e3e509381ajeffhao } 148610037c866b04550fc5461058c398c2e3e509381ajeffhao 148710037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->methods_size_ != 0) { 148810037c866b04550fc5461058c398c2e3e509381ajeffhao DexFile::MethodAnnotationsItem* method_items = (DexFile::MethodAnnotationsItem*) (item + 1); 1489e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_METHOD(method, method_items[0].method_idx_, "first_annotations_dir_definer method id", 14905e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = false; return DexFile::kDexNoIndex16) 1491e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return method->class_idx_; 149210037c866b04550fc5461058c398c2e3e509381ajeffhao } 149310037c866b04550fc5461058c398c2e3e509381ajeffhao 149410037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->parameters_size_ != 0) { 149510037c866b04550fc5461058c398c2e3e509381ajeffhao DexFile::ParameterAnnotationsItem* parameter_items = (DexFile::ParameterAnnotationsItem*) (item + 1); 1496e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_METHOD(method, parameter_items[0].method_idx_, "first_annotations_dir_definer method id", 14975e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe *success = false; return DexFile::kDexNoIndex16) 1498e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return method->class_idx_; 149910037c866b04550fc5461058c398c2e3e509381ajeffhao } 150010037c866b04550fc5461058c398c2e3e509381ajeffhao 150110037c866b04550fc5461058c398c2e3e509381ajeffhao return DexFile::kDexNoIndex16; 150210037c866b04550fc5461058c398c2e3e509381ajeffhao} 150310037c866b04550fc5461058c398c2e3e509381ajeffhao 150410037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterStringIdItem() { 150510037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::StringId* item = reinterpret_cast<const DexFile::StringId*>(ptr_); 150610037c866b04550fc5461058c398c2e3e509381ajeffhao 150710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the map to make sure it has the right offset->type. 150810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckOffsetToTypeMap(item->string_data_off_, DexFile::kDexTypeStringDataItem)) { 150910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 151010037c866b04550fc5461058c398c2e3e509381ajeffhao } 151110037c866b04550fc5461058c398c2e3e509381ajeffhao 151210037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. 15132cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (previous_item_ != nullptr) { 151410037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::StringId* prev_item = reinterpret_cast<const DexFile::StringId*>(previous_item_); 151510037c866b04550fc5461058c398c2e3e509381ajeffhao const char* prev_str = dex_file_->GetStringData(*prev_item); 151610037c866b04550fc5461058c398c2e3e509381ajeffhao const char* str = dex_file_->GetStringData(*item); 15178d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(CompareModifiedUtf8ToModifiedUtf8AsUtf16CodePointValues(prev_str, str) >= 0)) { 15188d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order string_ids: '%s' then '%s'", prev_str, str); 151910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 152010037c866b04550fc5461058c398c2e3e509381ajeffhao } 152110037c866b04550fc5461058c398c2e3e509381ajeffhao } 152210037c866b04550fc5461058c398c2e3e509381ajeffhao 152310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::StringId); 152410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 152510037c866b04550fc5461058c398c2e3e509381ajeffhao} 152610037c866b04550fc5461058c398c2e3e509381ajeffhao 152710037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterTypeIdItem() { 152810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TypeId* item = reinterpret_cast<const DexFile::TypeId*>(ptr_); 1529e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 1530e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING(descriptor, item->descriptor_idx_, "inter_type_id_item descriptor_idx") 153110037c866b04550fc5461058c398c2e3e509381ajeffhao 153210037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the descriptor is a valid type. 15338d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidDescriptor(descriptor))) { 15348d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid type descriptor: '%s'", descriptor); 153510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 153610037c866b04550fc5461058c398c2e3e509381ajeffhao } 153710037c866b04550fc5461058c398c2e3e509381ajeffhao 153810037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. 15392cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (previous_item_ != nullptr) { 154010037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TypeId* prev_item = reinterpret_cast<const DexFile::TypeId*>(previous_item_); 15418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->descriptor_idx_ >= item->descriptor_idx_)) { 15428d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order type_ids: %x then %x", 15438d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers prev_item->descriptor_idx_, item->descriptor_idx_); 154410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 154510037c866b04550fc5461058c398c2e3e509381ajeffhao } 154610037c866b04550fc5461058c398c2e3e509381ajeffhao } 154710037c866b04550fc5461058c398c2e3e509381ajeffhao 154810037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::TypeId); 154910037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 155010037c866b04550fc5461058c398c2e3e509381ajeffhao} 155110037c866b04550fc5461058c398c2e3e509381ajeffhao 155210037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterProtoIdItem() { 155310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ProtoId* item = reinterpret_cast<const DexFile::ProtoId*>(ptr_); 1554e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 1555e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING(shorty, item->shorty_idx_, "inter_proto_id_item shorty_idx") 1556e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe 155710037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->parameters_off_ != 0 && 155810037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->parameters_off_, DexFile::kDexTypeTypeList)) { 155910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 156010037c866b04550fc5461058c398c2e3e509381ajeffhao } 156110037c866b04550fc5461058c398c2e3e509381ajeffhao 156210037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the return type and advance the shorty. 1563e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(return_type, item->return_type_idx_, "inter_proto_id_item return_type_idx") 1564e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (!CheckShortyDescriptorMatch(*shorty, return_type, true)) { 156510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 156610037c866b04550fc5461058c398c2e3e509381ajeffhao } 156710037c866b04550fc5461058c398c2e3e509381ajeffhao shorty++; 156810037c866b04550fc5461058c398c2e3e509381ajeffhao 156910037c866b04550fc5461058c398c2e3e509381ajeffhao DexFileParameterIterator it(*dex_file_, *item); 157010037c866b04550fc5461058c398c2e3e509381ajeffhao while (it.HasNext() && *shorty != '\0') { 1571bb836e14541d5424328182f3e20ce08c691d041eAndreas Gampe if (!CheckIndex(it.GetTypeIdx(), dex_file_->NumTypeIds(), 1572bb836e14541d5424328182f3e20ce08c691d041eAndreas Gampe "inter_proto_id_item shorty type_idx")) { 1573bb836e14541d5424328182f3e20ce08c691d041eAndreas Gampe return false; 1574bb836e14541d5424328182f3e20ce08c691d041eAndreas Gampe } 157510037c866b04550fc5461058c398c2e3e509381ajeffhao const char* descriptor = it.GetDescriptor(); 157610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckShortyDescriptorMatch(*shorty, descriptor, false)) { 157710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 157810037c866b04550fc5461058c398c2e3e509381ajeffhao } 157910037c866b04550fc5461058c398c2e3e509381ajeffhao it.Next(); 158010037c866b04550fc5461058c398c2e3e509381ajeffhao shorty++; 158110037c866b04550fc5461058c398c2e3e509381ajeffhao } 15828d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(it.HasNext() || *shorty != '\0')) { 15838d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched length for parameters and shorty"); 158410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 158510037c866b04550fc5461058c398c2e3e509381ajeffhao } 158610037c866b04550fc5461058c398c2e3e509381ajeffhao 158710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. This relies on type_ids being in order. 15882cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (previous_item_ != nullptr) { 158910037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ProtoId* prev = reinterpret_cast<const DexFile::ProtoId*>(previous_item_); 15908d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev->return_type_idx_ > item->return_type_idx_)) { 15918d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order proto_id return types"); 159210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 159310037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev->return_type_idx_ == item->return_type_idx_) { 159410037c866b04550fc5461058c398c2e3e509381ajeffhao DexFileParameterIterator curr_it(*dex_file_, *item); 159510037c866b04550fc5461058c398c2e3e509381ajeffhao DexFileParameterIterator prev_it(*dex_file_, *prev); 159610037c866b04550fc5461058c398c2e3e509381ajeffhao 159710037c866b04550fc5461058c398c2e3e509381ajeffhao while (curr_it.HasNext() && prev_it.HasNext()) { 159810037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t prev_idx = prev_it.GetTypeIdx(); 159910037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t curr_idx = curr_it.GetTypeIdx(); 160010037c866b04550fc5461058c398c2e3e509381ajeffhao if (prev_idx == DexFile::kDexNoIndex16) { 160110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 160210037c866b04550fc5461058c398c2e3e509381ajeffhao } 16038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(curr_idx == DexFile::kDexNoIndex16)) { 16048d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order proto_id arguments"); 160510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 160610037c866b04550fc5461058c398c2e3e509381ajeffhao } 160710037c866b04550fc5461058c398c2e3e509381ajeffhao 160810037c866b04550fc5461058c398c2e3e509381ajeffhao if (prev_idx < curr_idx) { 160910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 16108d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } else if (UNLIKELY(prev_idx > curr_idx)) { 16118d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order proto_id arguments"); 161210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 161310037c866b04550fc5461058c398c2e3e509381ajeffhao } 161410037c866b04550fc5461058c398c2e3e509381ajeffhao 161510037c866b04550fc5461058c398c2e3e509381ajeffhao prev_it.Next(); 161610037c866b04550fc5461058c398c2e3e509381ajeffhao curr_it.Next(); 161710037c866b04550fc5461058c398c2e3e509381ajeffhao } 161810037c866b04550fc5461058c398c2e3e509381ajeffhao } 161910037c866b04550fc5461058c398c2e3e509381ajeffhao } 162010037c866b04550fc5461058c398c2e3e509381ajeffhao 162110037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ProtoId); 162210037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 162310037c866b04550fc5461058c398c2e3e509381ajeffhao} 162410037c866b04550fc5461058c398c2e3e509381ajeffhao 162510037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterFieldIdItem() { 162610037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldId* item = reinterpret_cast<const DexFile::FieldId*>(ptr_); 162710037c866b04550fc5461058c398c2e3e509381ajeffhao 162810037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the class descriptor is valid. 1629e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(class_descriptor, item->class_idx_, "inter_field_id_item class_idx") 1630e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(class_descriptor) || class_descriptor[0] != 'L')) { 1631e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid descriptor for class_idx: '%s'", class_descriptor); 163210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 163310037c866b04550fc5461058c398c2e3e509381ajeffhao } 163410037c866b04550fc5461058c398c2e3e509381ajeffhao 163510037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the type descriptor is a valid field name. 1636e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(type_descriptor, item->type_idx_, "inter_field_id_item type_idx") 1637e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(type_descriptor) || type_descriptor[0] == 'V')) { 1638e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid descriptor for type_idx: '%s'", type_descriptor); 163910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 164010037c866b04550fc5461058c398c2e3e509381ajeffhao } 164110037c866b04550fc5461058c398c2e3e509381ajeffhao 164210037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the name is valid. 1643e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING(descriptor, item->name_idx_, "inter_field_id_item name_idx") 16448d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidMemberName(descriptor))) { 16458d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid field name: '%s'", descriptor); 164610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 164710037c866b04550fc5461058c398c2e3e509381ajeffhao } 164810037c866b04550fc5461058c398c2e3e509381ajeffhao 164910037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. This relies on the other sections being in order. 16502cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (previous_item_ != nullptr) { 165110037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldId* prev_item = reinterpret_cast<const DexFile::FieldId*>(previous_item_); 16528d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->class_idx_ > item->class_idx_)) { 16538d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_ids"); 165410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 165510037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->class_idx_ == item->class_idx_) { 16568d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->name_idx_ > item->name_idx_)) { 16578d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_ids"); 165810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 165910037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->name_idx_ == item->name_idx_) { 16608d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->type_idx_ >= item->type_idx_)) { 16618d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_ids"); 166210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 166310037c866b04550fc5461058c398c2e3e509381ajeffhao } 166410037c866b04550fc5461058c398c2e3e509381ajeffhao } 166510037c866b04550fc5461058c398c2e3e509381ajeffhao } 166610037c866b04550fc5461058c398c2e3e509381ajeffhao } 166710037c866b04550fc5461058c398c2e3e509381ajeffhao 166810037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::FieldId); 166910037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 167010037c866b04550fc5461058c398c2e3e509381ajeffhao} 167110037c866b04550fc5461058c398c2e3e509381ajeffhao 167210037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterMethodIdItem() { 167310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodId* item = reinterpret_cast<const DexFile::MethodId*>(ptr_); 167410037c866b04550fc5461058c398c2e3e509381ajeffhao 167510037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the class descriptor is a valid reference name. 1676e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(class_descriptor, item->class_idx_, "inter_method_id_item class_idx") 1677e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(class_descriptor) || (class_descriptor[0] != 'L' && 1678e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe class_descriptor[0] != '['))) { 1679e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid descriptor for class_idx: '%s'", class_descriptor); 168010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 168110037c866b04550fc5461058c398c2e3e509381ajeffhao } 168210037c866b04550fc5461058c398c2e3e509381ajeffhao 168310037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the name is valid. 1684df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe LOAD_STRING(descriptor, item->name_idx_, "inter_method_id_item name_idx") 16858d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidMemberName(descriptor))) { 16868d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid method name: '%s'", descriptor); 168710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 168810037c866b04550fc5461058c398c2e3e509381ajeffhao } 168910037c866b04550fc5461058c398c2e3e509381ajeffhao 1690df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe // Check that the proto id is valid. 1691df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe if (UNLIKELY(!CheckIndex(item->proto_idx_, dex_file_->NumProtoIds(), 1692df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe "inter_method_id_item proto_idx"))) { 1693df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe return false; 1694df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe } 1695df10b32c4d0adfa86201169692eaa7ef038b642cAndreas Gampe 169610037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. This relies on the other sections being in order. 16972cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (previous_item_ != nullptr) { 169810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodId* prev_item = reinterpret_cast<const DexFile::MethodId*>(previous_item_); 16998d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->class_idx_ > item->class_idx_)) { 17008d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_ids"); 170110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 170210037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->class_idx_ == item->class_idx_) { 17038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->name_idx_ > item->name_idx_)) { 17048d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_ids"); 170510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 170610037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->name_idx_ == item->name_idx_) { 17078d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->proto_idx_ >= item->proto_idx_)) { 17088d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_ids"); 170910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 171010037c866b04550fc5461058c398c2e3e509381ajeffhao } 171110037c866b04550fc5461058c398c2e3e509381ajeffhao } 171210037c866b04550fc5461058c398c2e3e509381ajeffhao } 171310037c866b04550fc5461058c398c2e3e509381ajeffhao } 171410037c866b04550fc5461058c398c2e3e509381ajeffhao 171510037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::MethodId); 171610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 171710037c866b04550fc5461058c398c2e3e509381ajeffhao} 171810037c866b04550fc5461058c398c2e3e509381ajeffhao 171910037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterClassDefItem() { 172010037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ClassDef* item = reinterpret_cast<const DexFile::ClassDef*>(ptr_); 172110037c866b04550fc5461058c398c2e3e509381ajeffhao 17220ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe // Check for duplicate class def. 17230ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe if (defined_classes_.find(item->class_idx_) != defined_classes_.end()) { 17240ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe ErrorStringPrintf("Redefinition of class with type idx: '%d'", item->class_idx_); 17250ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe return false; 17260ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe } 17270ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe defined_classes_.insert(item->class_idx_); 17280ba238dcc21ae3544e1e8cb5d108725db8a1c134Andreas Gampe 1729e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(class_descriptor, item->class_idx_, "inter_class_def_item class_idx") 1730e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(class_descriptor) || class_descriptor[0] != 'L')) { 1731e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid class descriptor: '%s'", class_descriptor); 173210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 173310037c866b04550fc5461058c398c2e3e509381ajeffhao } 173410037c866b04550fc5461058c398c2e3e509381ajeffhao 1735acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe // Only allow non-runtime modifiers. 1736acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe if ((item->access_flags_ & ~kAccJavaFlagsMask) != 0) { 1737acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe ErrorStringPrintf("Invalid class flags: '%d'", item->access_flags_); 1738acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe return false; 1739acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe } 1740acc2bb693d83102f93007d7c4881a94bbcc3b9bbAndreas Gampe 174110037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->interfaces_off_ != 0 && 174210037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->interfaces_off_, DexFile::kDexTypeTypeList)) { 174310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 174410037c866b04550fc5461058c398c2e3e509381ajeffhao } 174510037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->annotations_off_ != 0 && 174610037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->annotations_off_, DexFile::kDexTypeAnnotationsDirectoryItem)) { 174710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 174810037c866b04550fc5461058c398c2e3e509381ajeffhao } 174910037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->class_data_off_ != 0 && 175010037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->class_data_off_, DexFile::kDexTypeClassDataItem)) { 175110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 175210037c866b04550fc5461058c398c2e3e509381ajeffhao } 175310037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->static_values_off_ != 0 && 175410037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->static_values_off_, DexFile::kDexTypeEncodedArrayItem)) { 175510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 175610037c866b04550fc5461058c398c2e3e509381ajeffhao } 175710037c866b04550fc5461058c398c2e3e509381ajeffhao 175810037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->superclass_idx_ != DexFile::kDexNoIndex16) { 1759e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(superclass_descriptor, item->superclass_idx_, 1760e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe "inter_class_def_item superclass_idx") 1761e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(superclass_descriptor) || superclass_descriptor[0] != 'L')) { 1762e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid superclass: '%s'", superclass_descriptor); 176310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 176410037c866b04550fc5461058c398c2e3e509381ajeffhao } 176510037c866b04550fc5461058c398c2e3e509381ajeffhao } 176610037c866b04550fc5461058c398c2e3e509381ajeffhao 176710037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TypeList* interfaces = dex_file_->GetInterfacesList(*item); 17682cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier if (interfaces != nullptr) { 176910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = interfaces->Size(); 177010037c866b04550fc5461058c398c2e3e509381ajeffhao 177110037c866b04550fc5461058c398c2e3e509381ajeffhao // Ensure that all interfaces refer to classes (not arrays or primitives). 177210037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < size; i++) { 1773e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_STRING_BY_TYPE(inf_descriptor, interfaces->GetTypeItem(i).type_idx_, 1774e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe "inter_class_def_item interface type_idx") 1775e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(!IsValidDescriptor(inf_descriptor) || inf_descriptor[0] != 'L')) { 1776e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe ErrorStringPrintf("Invalid interface: '%s'", inf_descriptor); 177710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 177810037c866b04550fc5461058c398c2e3e509381ajeffhao } 177910037c866b04550fc5461058c398c2e3e509381ajeffhao } 178010037c866b04550fc5461058c398c2e3e509381ajeffhao 178110037c866b04550fc5461058c398c2e3e509381ajeffhao /* 178210037c866b04550fc5461058c398c2e3e509381ajeffhao * Ensure that there are no duplicates. This is an O(N^2) test, but in 178310037c866b04550fc5461058c398c2e3e509381ajeffhao * practice the number of interfaces implemented by any given class is low. 178410037c866b04550fc5461058c398c2e3e509381ajeffhao */ 178510037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 1; i < size; i++) { 178610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx1 = interfaces->GetTypeItem(i).type_idx_; 178710037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t j =0; j < i; j++) { 178810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx2 = interfaces->GetTypeItem(j).type_idx_; 17898d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(idx1 == idx2)) { 17908d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Duplicate interface: '%s'", dex_file_->StringByTypeIdx(idx1)); 179110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 179210037c866b04550fc5461058c398c2e3e509381ajeffhao } 179310037c866b04550fc5461058c398c2e3e509381ajeffhao } 179410037c866b04550fc5461058c398c2e3e509381ajeffhao } 179510037c866b04550fc5461058c398c2e3e509381ajeffhao } 179610037c866b04550fc5461058c398c2e3e509381ajeffhao 179710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that references in class_data_item are to the right class. 179810037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->class_data_off_ != 0) { 179913735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* data = begin_ + item->class_data_off_; 18005e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe bool success; 18015e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe uint16_t data_definer = FindFirstClassDataDefiner(data, &success); 18025e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe if (!success) { 1803e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; 1804e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 18058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((data_definer != item->class_idx_) && (data_definer != DexFile::kDexNoIndex16))) { 18068d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid class_data_item"); 180710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 180810037c866b04550fc5461058c398c2e3e509381ajeffhao } 180910037c866b04550fc5461058c398c2e3e509381ajeffhao } 181010037c866b04550fc5461058c398c2e3e509381ajeffhao 181110037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that references in annotations_directory_item are to right class. 181210037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->annotations_off_ != 0) { 181313735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* data = begin_ + item->annotations_off_; 18145e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe bool success; 18155e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe uint16_t annotations_definer = FindFirstAnnotationsDirectoryDefiner(data, &success); 18165e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe if (!success) { 1817e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; 1818e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 18198d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((annotations_definer != item->class_idx_) && 18208d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers (annotations_definer != DexFile::kDexNoIndex16))) { 18218d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid annotations_directory_item"); 182210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 182310037c866b04550fc5461058c398c2e3e509381ajeffhao } 182410037c866b04550fc5461058c398c2e3e509381ajeffhao } 182510037c866b04550fc5461058c398c2e3e509381ajeffhao 182610037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ClassDef); 182710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 182810037c866b04550fc5461058c398c2e3e509381ajeffhao} 182910037c866b04550fc5461058c398c2e3e509381ajeffhao 183010037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterAnnotationSetRefList() { 183110037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationSetRefList* list = 183210037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationSetRefList*>(ptr_); 183310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationSetRefItem* item = list->list_; 183410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = list->size_; 183510037c866b04550fc5461058c398c2e3e509381ajeffhao 183610037c866b04550fc5461058c398c2e3e509381ajeffhao while (count--) { 183710037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->annotations_off_ != 0 && 183810037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 183910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 184010037c866b04550fc5461058c398c2e3e509381ajeffhao } 184110037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 184210037c866b04550fc5461058c398c2e3e509381ajeffhao } 184310037c866b04550fc5461058c398c2e3e509381ajeffhao 184413735955f39b3b304c37d2b2840663c131262c18Ian Rogers ptr_ = reinterpret_cast<const uint8_t*>(item); 184510037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 184610037c866b04550fc5461058c398c2e3e509381ajeffhao} 184710037c866b04550fc5461058c398c2e3e509381ajeffhao 184810037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterAnnotationSetItem() { 184910037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationSetItem* set = reinterpret_cast<const DexFile::AnnotationSetItem*>(ptr_); 185010037c866b04550fc5461058c398c2e3e509381ajeffhao const uint32_t* offsets = set->entries_; 185110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = set->size_; 185210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_idx = 0; 185310037c866b04550fc5461058c398c2e3e509381ajeffhao 185410037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < count; i++) { 185510037c866b04550fc5461058c398c2e3e509381ajeffhao if (*offsets != 0 && !CheckOffsetToTypeMap(*offsets, DexFile::kDexTypeAnnotationItem)) { 185610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 185710037c866b04550fc5461058c398c2e3e509381ajeffhao } 185810037c866b04550fc5461058c398c2e3e509381ajeffhao 185910037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the annotation from the offset and the type index for the annotation. 186010037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationItem* annotation = 186130fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers reinterpret_cast<const DexFile::AnnotationItem*>(begin_ + *offsets); 186210037c866b04550fc5461058c398c2e3e509381ajeffhao const uint8_t* data = annotation->annotation_; 186310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = DecodeUnsignedLeb128(&data); 186410037c866b04550fc5461058c398c2e3e509381ajeffhao 18658d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= idx && i != 0)) { 18668d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order entry types: %x then %x", last_idx, idx); 186710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 186810037c866b04550fc5461058c398c2e3e509381ajeffhao } 186910037c866b04550fc5461058c398c2e3e509381ajeffhao 187010037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = idx; 187110037c866b04550fc5461058c398c2e3e509381ajeffhao offsets++; 187210037c866b04550fc5461058c398c2e3e509381ajeffhao } 187310037c866b04550fc5461058c398c2e3e509381ajeffhao 187413735955f39b3b304c37d2b2840663c131262c18Ian Rogers ptr_ = reinterpret_cast<const uint8_t*>(offsets); 187510037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 187610037c866b04550fc5461058c398c2e3e509381ajeffhao} 187710037c866b04550fc5461058c398c2e3e509381ajeffhao 187810037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterClassDataItem() { 187910037c866b04550fc5461058c398c2e3e509381ajeffhao ClassDataItemIterator it(*dex_file_, ptr_); 18805e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe bool success; 18815e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe uint16_t defining_class = FindFirstClassDataDefiner(ptr_, &success); 18825e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe if (!success) { 1883e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; 1884e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 188510037c866b04550fc5461058c398c2e3e509381ajeffhao 188610037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextStaticField() || it.HasNextInstanceField(); it.Next()) { 18875e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_FIELD(field, it.GetMemberIndex(), "inter_class_data_item field_id", return false) 1888e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(field->class_idx_ != defining_class)) { 18898d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for class_data_item field"); 189010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 189110037c866b04550fc5461058c398c2e3e509381ajeffhao } 189210037c866b04550fc5461058c398c2e3e509381ajeffhao } 189310037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextDirectMethod() || it.HasNextVirtualMethod(); it.Next()) { 189410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t code_off = it.GetMethodCodeItemOffset(); 189510037c866b04550fc5461058c398c2e3e509381ajeffhao if (code_off != 0 && !CheckOffsetToTypeMap(code_off, DexFile::kDexTypeCodeItem)) { 189610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 189710037c866b04550fc5461058c398c2e3e509381ajeffhao } 18985e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_METHOD(method, it.GetMemberIndex(), "inter_class_data_item method_id", return false) 1899e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(method->class_idx_ != defining_class)) { 19008d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for class_data_item method"); 190110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 190210037c866b04550fc5461058c398c2e3e509381ajeffhao } 190310037c866b04550fc5461058c398c2e3e509381ajeffhao } 190410037c866b04550fc5461058c398c2e3e509381ajeffhao 190510037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = it.EndDataPointer(); 190610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 190710037c866b04550fc5461058c398c2e3e509381ajeffhao} 190810037c866b04550fc5461058c398c2e3e509381ajeffhao 190910037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterAnnotationsDirectoryItem() { 191010037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationsDirectoryItem* item = 191110037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationsDirectoryItem*>(ptr_); 19125e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe bool success; 19135e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe uint16_t defining_class = FindFirstAnnotationsDirectoryDefiner(ptr_, &success); 19145e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe if (!success) { 1915e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe return false; 1916e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe } 191710037c866b04550fc5461058c398c2e3e509381ajeffhao 191810037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->class_annotations_off_ != 0 && 191910037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->class_annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 192010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 192110037c866b04550fc5461058c398c2e3e509381ajeffhao } 192210037c866b04550fc5461058c398c2e3e509381ajeffhao 192310037c866b04550fc5461058c398c2e3e509381ajeffhao // Field annotations follow immediately after the annotations directory. 192410037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldAnnotationsItem* field_item = 192510037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::FieldAnnotationsItem*>(item + 1); 192610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t field_count = item->fields_size_; 192710037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < field_count; i++) { 19285e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe LOAD_FIELD(field, field_item->field_idx_, "inter_annotations_directory_item field_id", 19295e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe return false) 1930e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(field->class_idx_ != defining_class)) { 19318d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for field_annotation"); 193210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 193310037c866b04550fc5461058c398c2e3e509381ajeffhao } 193410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckOffsetToTypeMap(field_item->annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 193510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 193610037c866b04550fc5461058c398c2e3e509381ajeffhao } 193710037c866b04550fc5461058c398c2e3e509381ajeffhao field_item++; 193810037c866b04550fc5461058c398c2e3e509381ajeffhao } 193910037c866b04550fc5461058c398c2e3e509381ajeffhao 194010037c866b04550fc5461058c398c2e3e509381ajeffhao // Method annotations follow immediately after field annotations. 194110037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodAnnotationsItem* method_item = 194210037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::MethodAnnotationsItem*>(field_item); 194310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t method_count = item->methods_size_; 194410037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < method_count; i++) { 1945e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_METHOD(method, method_item->method_idx_, "inter_annotations_directory_item method_id", 19465e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe return false) 1947e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(method->class_idx_ != defining_class)) { 19488d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for method_annotation"); 194910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 195010037c866b04550fc5461058c398c2e3e509381ajeffhao } 195110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckOffsetToTypeMap(method_item->annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 195210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 195310037c866b04550fc5461058c398c2e3e509381ajeffhao } 195410037c866b04550fc5461058c398c2e3e509381ajeffhao method_item++; 195510037c866b04550fc5461058c398c2e3e509381ajeffhao } 195610037c866b04550fc5461058c398c2e3e509381ajeffhao 195710037c866b04550fc5461058c398c2e3e509381ajeffhao // Parameter annotations follow immediately after method annotations. 195810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ParameterAnnotationsItem* parameter_item = 195910037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::ParameterAnnotationsItem*>(method_item); 196010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameter_count = item->parameters_size_; 196110037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < parameter_count; i++) { 1962e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe LOAD_METHOD(parameter_method, parameter_item->method_idx_, 19635e31ddadd29325649260aa186e9ffa8ccdb370a2Andreas Gampe "inter_annotations_directory_item parameter method_id", return false) 1964e09269ca05e3014e86198e9a2cf6092026fafefdAndreas Gampe if (UNLIKELY(parameter_method->class_idx_ != defining_class)) { 19658d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for parameter_annotation"); 196610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 196710037c866b04550fc5461058c398c2e3e509381ajeffhao } 19682b87ddf36abff711fa2233c49bffc7ceb03b15d7Dragos Sbirlea if (!CheckOffsetToTypeMap(parameter_item->annotations_off_, 19692b87ddf36abff711fa2233c49bffc7ceb03b15d7Dragos Sbirlea DexFile::kDexTypeAnnotationSetRefList)) { 197010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 197110037c866b04550fc5461058c398c2e3e509381ajeffhao } 197210037c866b04550fc5461058c398c2e3e509381ajeffhao parameter_item++; 197310037c866b04550fc5461058c398c2e3e509381ajeffhao } 197410037c866b04550fc5461058c398c2e3e509381ajeffhao 197513735955f39b3b304c37d2b2840663c131262c18Ian Rogers ptr_ = reinterpret_cast<const uint8_t*>(parameter_item); 197610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 197710037c866b04550fc5461058c398c2e3e509381ajeffhao} 197810037c866b04550fc5461058c398c2e3e509381ajeffhao 19798a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckInterSectionIterate(size_t offset, uint32_t count, uint16_t type) { 198010037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the right alignment mask for the type of section. 19818a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t alignment_mask; 198210037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 198310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 198410037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint8_t) - 1; 198510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 198610037c866b04550fc5461058c398c2e3e509381ajeffhao default: 198710037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint32_t) - 1; 198810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 198910037c866b04550fc5461058c398c2e3e509381ajeffhao } 199010037c866b04550fc5461058c398c2e3e509381ajeffhao 199110037c866b04550fc5461058c398c2e3e509381ajeffhao // Iterate through the items in the section. 19922cebb24bfc3247d3e9be138a3350106737455918Mathieu Chartier previous_item_ = nullptr; 199310037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < count; i++) { 199410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t new_offset = (offset + alignment_mask) & ~alignment_mask; 199530fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers ptr_ = begin_ + new_offset; 199613735955f39b3b304c37d2b2840663c131262c18Ian Rogers const uint8_t* prev_ptr = ptr_; 199710037c866b04550fc5461058c398c2e3e509381ajeffhao 199810037c866b04550fc5461058c398c2e3e509381ajeffhao // Check depending on the section type. 199910037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 200010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: { 200110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterStringIdItem()) { 200210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 200310037c866b04550fc5461058c398c2e3e509381ajeffhao } 200410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 200510037c866b04550fc5461058c398c2e3e509381ajeffhao } 200610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: { 200710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterTypeIdItem()) { 200810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 200910037c866b04550fc5461058c398c2e3e509381ajeffhao } 201010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 201110037c866b04550fc5461058c398c2e3e509381ajeffhao } 201210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: { 201310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterProtoIdItem()) { 201410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 201510037c866b04550fc5461058c398c2e3e509381ajeffhao } 201610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 201710037c866b04550fc5461058c398c2e3e509381ajeffhao } 201810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: { 201910037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterFieldIdItem()) { 202010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 202110037c866b04550fc5461058c398c2e3e509381ajeffhao } 202210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 202310037c866b04550fc5461058c398c2e3e509381ajeffhao } 202410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: { 202510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterMethodIdItem()) { 202610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 202710037c866b04550fc5461058c398c2e3e509381ajeffhao } 202810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 202910037c866b04550fc5461058c398c2e3e509381ajeffhao } 203010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: { 203110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterClassDefItem()) { 203210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 203310037c866b04550fc5461058c398c2e3e509381ajeffhao } 203410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 203510037c866b04550fc5461058c398c2e3e509381ajeffhao } 203610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: { 203710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterAnnotationSetRefList()) { 203810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 203910037c866b04550fc5461058c398c2e3e509381ajeffhao } 204010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 204110037c866b04550fc5461058c398c2e3e509381ajeffhao } 204210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: { 204310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterAnnotationSetItem()) { 204410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 204510037c866b04550fc5461058c398c2e3e509381ajeffhao } 204610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 204710037c866b04550fc5461058c398c2e3e509381ajeffhao } 204810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: { 204910037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterClassDataItem()) { 205010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 205110037c866b04550fc5461058c398c2e3e509381ajeffhao } 205210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 205310037c866b04550fc5461058c398c2e3e509381ajeffhao } 205410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: { 205510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterAnnotationsDirectoryItem()) { 205610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 205710037c866b04550fc5461058c398c2e3e509381ajeffhao } 205810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 205910037c866b04550fc5461058c398c2e3e509381ajeffhao } 206010037c866b04550fc5461058c398c2e3e509381ajeffhao default: 20618d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 206210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 206310037c866b04550fc5461058c398c2e3e509381ajeffhao } 206410037c866b04550fc5461058c398c2e3e509381ajeffhao 206510037c866b04550fc5461058c398c2e3e509381ajeffhao previous_item_ = prev_ptr; 20668a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers offset = ptr_ - begin_; 206710037c866b04550fc5461058c398c2e3e509381ajeffhao } 206810037c866b04550fc5461058c398c2e3e509381ajeffhao 206910037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 207010037c866b04550fc5461058c398c2e3e509381ajeffhao} 207110037c866b04550fc5461058c398c2e3e509381ajeffhao 207210037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterSection() { 207330fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers const DexFile::MapList* map = reinterpret_cast<const DexFile::MapList*>(begin_ + header_->map_off_); 207410037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MapItem* item = map->list_; 207510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = map->size_; 207610037c866b04550fc5461058c398c2e3e509381ajeffhao 207710037c866b04550fc5461058c398c2e3e509381ajeffhao // Cross check the items listed in the map. 207810037c866b04550fc5461058c398c2e3e509381ajeffhao while (count--) { 207910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_offset = item->offset_; 208010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_count = item->size_; 208110037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t type = item->type_; 208210037c866b04550fc5461058c398c2e3e509381ajeffhao 208310037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 208410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: 208510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMapList: 208610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: 208710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: 208810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: 208910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: 209010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: 209110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: 209210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 209310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 209410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 209510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 209610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 209710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 209810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 209910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: 210010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: 210110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 210210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: { 210310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterSectionIterate(section_offset, section_count, type)) { 210410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 210510037c866b04550fc5461058c398c2e3e509381ajeffhao } 210610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 210710037c866b04550fc5461058c398c2e3e509381ajeffhao } 210810037c866b04550fc5461058c398c2e3e509381ajeffhao default: 21098d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 211010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 211110037c866b04550fc5461058c398c2e3e509381ajeffhao } 211210037c866b04550fc5461058c398c2e3e509381ajeffhao 211310037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 211410037c866b04550fc5461058c398c2e3e509381ajeffhao } 211510037c866b04550fc5461058c398c2e3e509381ajeffhao 211610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 211710037c866b04550fc5461058c398c2e3e509381ajeffhao} 211810037c866b04550fc5461058c398c2e3e509381ajeffhao 211910037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::Verify() { 212010037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the header. 212110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckHeader()) { 212210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 212310037c866b04550fc5461058c398c2e3e509381ajeffhao } 212410037c866b04550fc5461058c398c2e3e509381ajeffhao 212510037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the map section. 212610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckMap()) { 212710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 212810037c866b04550fc5461058c398c2e3e509381ajeffhao } 212910037c866b04550fc5461058c398c2e3e509381ajeffhao 213010037c866b04550fc5461058c398c2e3e509381ajeffhao // Check structure within remaining sections. 213110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraSection()) { 213210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 213310037c866b04550fc5461058c398c2e3e509381ajeffhao } 213410037c866b04550fc5461058c398c2e3e509381ajeffhao 213510037c866b04550fc5461058c398c2e3e509381ajeffhao // Check references from one section to another. 213610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterSection()) { 213710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 213810037c866b04550fc5461058c398c2e3e509381ajeffhao } 213910037c866b04550fc5461058c398c2e3e509381ajeffhao 214010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 214110037c866b04550fc5461058c398c2e3e509381ajeffhao} 214210037c866b04550fc5461058c398c2e3e509381ajeffhao 21438d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersvoid DexFileVerifier::ErrorStringPrintf(const char* fmt, ...) { 21448d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers va_list ap; 21458d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers va_start(ap, fmt); 21468d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers DCHECK(failure_reason_.empty()) << failure_reason_; 21478d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers failure_reason_ = StringPrintf("Failure to verify dex file '%s': ", location_); 21488d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers StringAppendV(&failure_reason_, fmt, ap); 21498d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers va_end(ap); 21508d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers} 21518d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers 215210037c866b04550fc5461058c398c2e3e509381ajeffhao} // namespace art 2153