dex_file_verifier.cc revision e3d5581266301e6a672af6233220037abf52fea1
12faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes/* 22faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * Copyright (C) 2011 The Android Open Source Project 32faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * 42faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * Licensed under the Apache License, Version 2.0 (the "License"); 52faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * you may not use this file except in compliance with the License. 62faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * You may obtain a copy of the License at 72faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * 82faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * http://www.apache.org/licenses/LICENSE-2.0 92faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * 102faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * Unless required by applicable law or agreed to in writing, software 112faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * distributed under the License is distributed on an "AS IS" BASIS, 122faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 132faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * See the License for the specific language governing permissions and 142faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes * limitations under the License. 152faa5f1271587cda765f26bcf2951065300a01ffElliott Hughes */ 1610037c866b04550fc5461058c398c2e3e509381ajeffhao 1710037c866b04550fc5461058c398c2e3e509381ajeffhao#include "dex_file_verifier.h" 1810037c866b04550fc5461058c398c2e3e509381ajeffhao 1992572be7f754c213e615a62955cc5f65ca8c0c0eNarayan Kamath#include <zlib.h> 20700a402244a1a423da4f3ba8032459f4b65fa18fIan Rogers#include <memory> 2192572be7f754c213e615a62955cc5f65ca8c0c0eNarayan Kamath 22e222ee0b794f941af4fb1b32fb8224e32942ea7bElliott Hughes#include "base/stringprintf.h" 234f6ad8ab428038129b2d0d6c40b7fd625cca15e1Ian Rogers#include "dex_file-inl.h" 2410037c866b04550fc5461058c398c2e3e509381ajeffhao#include "leb128.h" 25a0e180632411f7fe0edf454e571c42209ee7b540Elliott Hughes#include "safe_map.h" 26a67249065e4c9b3cf4a7c081d95a78df28291ee9Ian Rogers#include "utf-inl.h" 272dd0e2cea360bc9206eb88ecc40d259e796c239dIan Rogers#include "utils.h" 2810037c866b04550fc5461058c398c2e3e509381ajeffhao 2910037c866b04550fc5461058c398c2e3e509381ajeffhaonamespace art { 3010037c866b04550fc5461058c398c2e3e509381ajeffhao 3110037c866b04550fc5461058c398c2e3e509381ajeffhaostatic uint32_t MapTypeToBitMask(uint32_t map_type) { 3210037c866b04550fc5461058c398c2e3e509381ajeffhao switch (map_type) { 3310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: return 1 << 0; 3410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: return 1 << 1; 3510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: return 1 << 2; 3610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: return 1 << 3; 3710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: return 1 << 4; 3810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: return 1 << 5; 3910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: return 1 << 6; 4010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMapList: return 1 << 7; 4110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: return 1 << 8; 4210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: return 1 << 9; 4310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: return 1 << 10; 4410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: return 1 << 11; 4510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: return 1 << 12; 4610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: return 1 << 13; 4710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: return 1 << 14; 4810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: return 1 << 15; 4910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: return 1 << 16; 5010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: return 1 << 17; 5110037c866b04550fc5461058c398c2e3e509381ajeffhao } 5210037c866b04550fc5461058c398c2e3e509381ajeffhao return 0; 5310037c866b04550fc5461058c398c2e3e509381ajeffhao} 5410037c866b04550fc5461058c398c2e3e509381ajeffhao 5510037c866b04550fc5461058c398c2e3e509381ajeffhaostatic bool IsDataSectionType(uint32_t map_type) { 5610037c866b04550fc5461058c398c2e3e509381ajeffhao switch (map_type) { 5710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: 5810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 5910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 6010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 6110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 6210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 6310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 6410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 6510037c866b04550fc5461058c398c2e3e509381ajeffhao } 6610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 6710037c866b04550fc5461058c398c2e3e509381ajeffhao} 6810037c866b04550fc5461058c398c2e3e509381ajeffhao 698d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::Verify(const DexFile* dex_file, const byte* begin, size_t size, 708d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers const char* location, std::string* error_msg) { 71700a402244a1a423da4f3ba8032459f4b65fa18fIan Rogers std::unique_ptr<DexFileVerifier> verifier(new DexFileVerifier(dex_file, begin, size, location)); 728d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (!verifier->Verify()) { 738d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers *error_msg = verifier->FailureReason(); 748d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers return false; 758d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } 768d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers return true; 778d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers} 788d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers 798d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckShortyDescriptorMatch(char shorty_char, const char* descriptor, 808d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers bool is_return_type) { 8110037c866b04550fc5461058c398c2e3e509381ajeffhao switch (shorty_char) { 8210037c866b04550fc5461058c398c2e3e509381ajeffhao case 'V': 838d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!is_return_type)) { 848d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid use of void"); 8510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 8610037c866b04550fc5461058c398c2e3e509381ajeffhao } 8710037c866b04550fc5461058c398c2e3e509381ajeffhao // Intentional fallthrough. 8810037c866b04550fc5461058c398c2e3e509381ajeffhao case 'B': 8910037c866b04550fc5461058c398c2e3e509381ajeffhao case 'C': 9010037c866b04550fc5461058c398c2e3e509381ajeffhao case 'D': 9110037c866b04550fc5461058c398c2e3e509381ajeffhao case 'F': 9210037c866b04550fc5461058c398c2e3e509381ajeffhao case 'I': 9310037c866b04550fc5461058c398c2e3e509381ajeffhao case 'J': 9410037c866b04550fc5461058c398c2e3e509381ajeffhao case 'S': 9510037c866b04550fc5461058c398c2e3e509381ajeffhao case 'Z': 968d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((descriptor[0] != shorty_char) || (descriptor[1] != '\0'))) { 978d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Shorty vs. primitive type mismatch: '%c', '%s'", 988d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers shorty_char, descriptor); 9910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 10010037c866b04550fc5461058c398c2e3e509381ajeffhao } 10110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 10210037c866b04550fc5461058c398c2e3e509381ajeffhao case 'L': 1038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((descriptor[0] != 'L') && (descriptor[0] != '['))) { 1048d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Shorty vs. type mismatch: '%c', '%s'", shorty_char, descriptor); 10510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 10610037c866b04550fc5461058c398c2e3e509381ajeffhao } 10710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 10810037c866b04550fc5461058c398c2e3e509381ajeffhao default: 1098d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad shorty character: '%c'", shorty_char); 11010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 11110037c866b04550fc5461058c398c2e3e509381ajeffhao } 11210037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 11310037c866b04550fc5461058c398c2e3e509381ajeffhao} 11410037c866b04550fc5461058c398c2e3e509381ajeffhao 1158d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckPointerRange(const void* start, const void* end, const char* label) { 1168a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers const byte* range_start = reinterpret_cast<const byte*>(start); 1178a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers const byte* range_end = reinterpret_cast<const byte*>(end); 1188a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers const byte* file_start = reinterpret_cast<const byte*>(begin_); 1198a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers const byte* file_end = file_start + size_; 1208d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((range_start < file_start) || (range_start > file_end) || 1218d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers (range_end < file_start) || (range_end > file_end))) { 1228a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Bad range for %s: %zx to %zx", label, 123e3d5581266301e6a672af6233220037abf52fea1Ian Rogers static_cast<size_t>(range_start - file_start), 124e3d5581266301e6a672af6233220037abf52fea1Ian Rogers static_cast<size_t>(range_end - file_start)); 12510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 12610037c866b04550fc5461058c398c2e3e509381ajeffhao } 12710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 12810037c866b04550fc5461058c398c2e3e509381ajeffhao} 12910037c866b04550fc5461058c398c2e3e509381ajeffhao 13010037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckListSize(const void* start, uint32_t count, 1318d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers uint32_t element_size, const char* label) { 13210037c866b04550fc5461058c398c2e3e509381ajeffhao const byte* list_start = reinterpret_cast<const byte*>(start); 13310037c866b04550fc5461058c398c2e3e509381ajeffhao return CheckPointerRange(list_start, list_start + (count * element_size), label); 13410037c866b04550fc5461058c398c2e3e509381ajeffhao} 13510037c866b04550fc5461058c398c2e3e509381ajeffhao 1368d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckIndex(uint32_t field, uint32_t limit, const char* label) { 1378d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(field >= limit)) { 1388d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad index for %s: %x >= %x", label, field, limit); 13910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 14010037c866b04550fc5461058c398c2e3e509381ajeffhao } 14110037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 14210037c866b04550fc5461058c398c2e3e509381ajeffhao} 14310037c866b04550fc5461058c398c2e3e509381ajeffhao 1448d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckHeader() { 145f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao // Check file size from the header. 146f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao uint32_t expected_size = header_->file_size_; 147f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao if (size_ != expected_size) { 1488d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad file size (%zd, expected %ud)", size_, expected_size); 14910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 15010037c866b04550fc5461058c398c2e3e509381ajeffhao } 15110037c866b04550fc5461058c398c2e3e509381ajeffhao 15210037c866b04550fc5461058c398c2e3e509381ajeffhao // Compute and verify the checksum in the header. 15310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t adler_checksum = adler32(0L, Z_NULL, 0); 15410037c866b04550fc5461058c398c2e3e509381ajeffhao const uint32_t non_sum = sizeof(header_->magic_) + sizeof(header_->checksum_); 15510037c866b04550fc5461058c398c2e3e509381ajeffhao const byte* non_sum_ptr = reinterpret_cast<const byte*>(header_) + non_sum; 156f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao adler_checksum = adler32(adler_checksum, non_sum_ptr, expected_size - non_sum); 15710037c866b04550fc5461058c398c2e3e509381ajeffhao if (adler_checksum != header_->checksum_) { 1588d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad checksum (%08x, expected %08x)", adler_checksum, header_->checksum_); 15910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 16010037c866b04550fc5461058c398c2e3e509381ajeffhao } 16110037c866b04550fc5461058c398c2e3e509381ajeffhao 16210037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the contents of the header. 16310037c866b04550fc5461058c398c2e3e509381ajeffhao if (header_->endian_tag_ != DexFile::kDexEndianConstant) { 1648d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unexpected endian_tag: %x", header_->endian_tag_); 16510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 16610037c866b04550fc5461058c398c2e3e509381ajeffhao } 16710037c866b04550fc5461058c398c2e3e509381ajeffhao 16810037c866b04550fc5461058c398c2e3e509381ajeffhao if (header_->header_size_ != sizeof(DexFile::Header)) { 1698d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad header size: %ud", header_->header_size_); 17010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 17110037c866b04550fc5461058c398c2e3e509381ajeffhao } 17210037c866b04550fc5461058c398c2e3e509381ajeffhao 17310037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 17410037c866b04550fc5461058c398c2e3e509381ajeffhao} 17510037c866b04550fc5461058c398c2e3e509381ajeffhao 1768d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersbool DexFileVerifier::CheckMap() { 17730fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers const DexFile::MapList* map = reinterpret_cast<const DexFile::MapList*>(begin_ + header_->map_off_); 17810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MapItem* item = map->list_; 17910037c866b04550fc5461058c398c2e3e509381ajeffhao 18010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = map->size_; 18110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_offset = 0; 18210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t data_item_count = 0; 18310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t data_items_left = header_->data_size_; 18410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t used_bits = 0; 18510037c866b04550fc5461058c398c2e3e509381ajeffhao 18610037c866b04550fc5461058c398c2e3e509381ajeffhao // Sanity check the size of the map list. 18710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(item, count, sizeof(DexFile::MapItem), "map size")) { 18810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 18910037c866b04550fc5461058c398c2e3e509381ajeffhao } 19010037c866b04550fc5461058c398c2e3e509381ajeffhao 19110037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the items listed in the map. 19210037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < count; i++) { 1938d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_offset >= item->offset_ && i != 0)) { 1948d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out of order map item: %x then %x", last_offset, item->offset_); 19510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 19610037c866b04550fc5461058c398c2e3e509381ajeffhao } 1978d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(item->offset_ >= header_->file_size_)) { 1988d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map item after end of file: %x, size %x", 1998d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers item->offset_, header_->file_size_); 20010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 20110037c866b04550fc5461058c398c2e3e509381ajeffhao } 20210037c866b04550fc5461058c398c2e3e509381ajeffhao 20310037c866b04550fc5461058c398c2e3e509381ajeffhao if (IsDataSectionType(item->type_)) { 20410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t icount = item->size_; 2058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(icount > data_items_left)) { 2068d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Too many items in data section: %ud", data_item_count + icount); 20710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 20810037c866b04550fc5461058c398c2e3e509381ajeffhao } 20910037c866b04550fc5461058c398c2e3e509381ajeffhao data_items_left -= icount; 21010037c866b04550fc5461058c398c2e3e509381ajeffhao data_item_count += icount; 21110037c866b04550fc5461058c398c2e3e509381ajeffhao } 21210037c866b04550fc5461058c398c2e3e509381ajeffhao 21310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t bit = MapTypeToBitMask(item->type_); 21410037c866b04550fc5461058c398c2e3e509381ajeffhao 2158d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(bit == 0)) { 2168d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map section type %x", item->type_); 21710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 21810037c866b04550fc5461058c398c2e3e509381ajeffhao } 21910037c866b04550fc5461058c398c2e3e509381ajeffhao 2208d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & bit) != 0)) { 2218d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Duplicate map section of type %x", item->type_); 22210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 22310037c866b04550fc5461058c398c2e3e509381ajeffhao } 22410037c866b04550fc5461058c398c2e3e509381ajeffhao 22510037c866b04550fc5461058c398c2e3e509381ajeffhao used_bits |= bit; 22610037c866b04550fc5461058c398c2e3e509381ajeffhao last_offset = item->offset_; 22710037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 22810037c866b04550fc5461058c398c2e3e509381ajeffhao } 22910037c866b04550fc5461058c398c2e3e509381ajeffhao 23010037c866b04550fc5461058c398c2e3e509381ajeffhao // Check for missing sections in the map. 2318d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeHeaderItem)) == 0)) { 2328d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing header entry"); 23310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 23410037c866b04550fc5461058c398c2e3e509381ajeffhao } 2358d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeMapList)) == 0)) { 2368d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing map_list entry"); 23710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 23810037c866b04550fc5461058c398c2e3e509381ajeffhao } 2398d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeStringIdItem)) == 0 && 2408d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->string_ids_off_ != 0) || (header_->string_ids_size_ != 0)))) { 2418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing string_ids entry"); 24210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 24310037c866b04550fc5461058c398c2e3e509381ajeffhao } 2448d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeTypeIdItem)) == 0 && 2458d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->type_ids_off_ != 0) || (header_->type_ids_size_ != 0)))) { 2468d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing type_ids entry"); 24710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 24810037c866b04550fc5461058c398c2e3e509381ajeffhao } 2498d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeProtoIdItem)) == 0 && 2508d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->proto_ids_off_ != 0) || (header_->proto_ids_size_ != 0)))) { 2518d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing proto_ids entry"); 25210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 25310037c866b04550fc5461058c398c2e3e509381ajeffhao } 2548d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeFieldIdItem)) == 0 && 2558d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->field_ids_off_ != 0) || (header_->field_ids_size_ != 0)))) { 2568d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing field_ids entry"); 25710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 25810037c866b04550fc5461058c398c2e3e509381ajeffhao } 2598d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeMethodIdItem)) == 0 && 2608d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->method_ids_off_ != 0) || (header_->method_ids_size_ != 0)))) { 2618d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing method_ids entry"); 26210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 26310037c866b04550fc5461058c398c2e3e509381ajeffhao } 2648d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((used_bits & MapTypeToBitMask(DexFile::kDexTypeClassDefItem)) == 0 && 2658d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ((header_->class_defs_off_ != 0) || (header_->class_defs_size_ != 0)))) { 2668d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map is missing class_defs entry"); 26710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 26810037c866b04550fc5461058c398c2e3e509381ajeffhao } 26910037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 27010037c866b04550fc5461058c398c2e3e509381ajeffhao} 27110037c866b04550fc5461058c398c2e3e509381ajeffhao 27210037c866b04550fc5461058c398c2e3e509381ajeffhaouint32_t DexFileVerifier::ReadUnsignedLittleEndian(uint32_t size) { 27310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t result = 0; 2748d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (LIKELY(CheckPointerRange(ptr_, ptr_ + size, "encoded_value"))) { 2758d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers for (uint32_t i = 0; i < size; i++) { 2768d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers result |= ((uint32_t) *(ptr_++)) << (i * 8); 2778d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } 27810037c866b04550fc5461058c398c2e3e509381ajeffhao } 27910037c866b04550fc5461058c398c2e3e509381ajeffhao return result; 28010037c866b04550fc5461058c398c2e3e509381ajeffhao} 28110037c866b04550fc5461058c398c2e3e509381ajeffhao 28210037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckAndGetHandlerOffsets(const DexFile::CodeItem* code_item, 2838d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers uint32_t* handler_offsets, uint32_t handlers_size) { 28410037c866b04550fc5461058c398c2e3e509381ajeffhao const byte* handlers_base = DexFile::GetCatchHandlerData(*code_item, 0); 28510037c866b04550fc5461058c398c2e3e509381ajeffhao 28610037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < handlers_size; i++) { 28710037c866b04550fc5461058c398c2e3e509381ajeffhao bool catch_all; 2888a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t offset = ptr_ - handlers_base; 28910037c866b04550fc5461058c398c2e3e509381ajeffhao int32_t size = DecodeSignedLeb128(&ptr_); 29010037c866b04550fc5461058c398c2e3e509381ajeffhao 2918d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((size < -65536) || (size > 65536))) { 2928d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid exception handler size: %d", size); 29310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 29410037c866b04550fc5461058c398c2e3e509381ajeffhao } 29510037c866b04550fc5461058c398c2e3e509381ajeffhao 29610037c866b04550fc5461058c398c2e3e509381ajeffhao if (size <= 0) { 29710037c866b04550fc5461058c398c2e3e509381ajeffhao catch_all = true; 29810037c866b04550fc5461058c398c2e3e509381ajeffhao size = -size; 29910037c866b04550fc5461058c398c2e3e509381ajeffhao } else { 30010037c866b04550fc5461058c398c2e3e509381ajeffhao catch_all = false; 30110037c866b04550fc5461058c398c2e3e509381ajeffhao } 30210037c866b04550fc5461058c398c2e3e509381ajeffhao 3038a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers handler_offsets[i] = static_cast<uint32_t>(offset); 30410037c866b04550fc5461058c398c2e3e509381ajeffhao 30510037c866b04550fc5461058c398c2e3e509381ajeffhao while (size-- > 0) { 30610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t type_idx = DecodeUnsignedLeb128(&ptr_); 30710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(type_idx, header_->type_ids_size_, "handler type_idx")) { 30810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 30910037c866b04550fc5461058c398c2e3e509381ajeffhao } 31010037c866b04550fc5461058c398c2e3e509381ajeffhao 31110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t addr = DecodeUnsignedLeb128(&ptr_); 3128d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(addr >= code_item->insns_size_in_code_units_)) { 3138d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid handler addr: %x", addr); 31410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 31510037c866b04550fc5461058c398c2e3e509381ajeffhao } 31610037c866b04550fc5461058c398c2e3e509381ajeffhao } 31710037c866b04550fc5461058c398c2e3e509381ajeffhao 31810037c866b04550fc5461058c398c2e3e509381ajeffhao if (catch_all) { 31910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t addr = DecodeUnsignedLeb128(&ptr_); 3208d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(addr >= code_item->insns_size_in_code_units_)) { 3218d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid handler catch_all_addr: %x", addr); 32210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 32310037c866b04550fc5461058c398c2e3e509381ajeffhao } 32410037c866b04550fc5461058c398c2e3e509381ajeffhao } 32510037c866b04550fc5461058c398c2e3e509381ajeffhao } 32610037c866b04550fc5461058c398c2e3e509381ajeffhao 32710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 32810037c866b04550fc5461058c398c2e3e509381ajeffhao} 32910037c866b04550fc5461058c398c2e3e509381ajeffhao 33010037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckClassDataItemField(uint32_t idx, uint32_t access_flags, 3318d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers bool expect_static) { 33210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->field_ids_size_, "class_data_item field_idx")) { 33310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 33410037c866b04550fc5461058c398c2e3e509381ajeffhao } 33510037c866b04550fc5461058c398c2e3e509381ajeffhao 33610037c866b04550fc5461058c398c2e3e509381ajeffhao bool is_static = (access_flags & kAccStatic) != 0; 3378d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(is_static != expect_static)) { 3388d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Static/instance field not in expected list"); 33910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 34010037c866b04550fc5461058c398c2e3e509381ajeffhao } 34110037c866b04550fc5461058c398c2e3e509381ajeffhao 34210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t access_field_mask = kAccPublic | kAccPrivate | kAccProtected | kAccStatic | 34310037c866b04550fc5461058c398c2e3e509381ajeffhao kAccFinal | kAccVolatile | kAccTransient | kAccSynthetic | kAccEnum; 3448d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((access_flags & ~access_field_mask) != 0)) { 3458d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad class_data_item field access_flags %x", access_flags); 34610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 34710037c866b04550fc5461058c398c2e3e509381ajeffhao } 34810037c866b04550fc5461058c398c2e3e509381ajeffhao 34910037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 35010037c866b04550fc5461058c398c2e3e509381ajeffhao} 35110037c866b04550fc5461058c398c2e3e509381ajeffhao 35210037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckClassDataItemMethod(uint32_t idx, uint32_t access_flags, 3538d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers uint32_t code_offset, bool expect_direct) { 35410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->method_ids_size_, "class_data_item method_idx")) { 35510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 35610037c866b04550fc5461058c398c2e3e509381ajeffhao } 35710037c866b04550fc5461058c398c2e3e509381ajeffhao 35810037c866b04550fc5461058c398c2e3e509381ajeffhao bool is_direct = (access_flags & (kAccStatic | kAccPrivate | kAccConstructor)) != 0; 35910037c866b04550fc5461058c398c2e3e509381ajeffhao bool expect_code = (access_flags & (kAccNative | kAccAbstract)) == 0; 36010037c866b04550fc5461058c398c2e3e509381ajeffhao bool is_synchronized = (access_flags & kAccSynchronized) != 0; 36110037c866b04550fc5461058c398c2e3e509381ajeffhao bool allow_synchronized = (access_flags & kAccNative) != 0; 36210037c866b04550fc5461058c398c2e3e509381ajeffhao 3638d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(is_direct != expect_direct)) { 3648d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Direct/virtual method not in expected list"); 36510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 36610037c866b04550fc5461058c398c2e3e509381ajeffhao } 36710037c866b04550fc5461058c398c2e3e509381ajeffhao 36810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t access_method_mask = kAccPublic | kAccPrivate | kAccProtected | kAccStatic | 36910037c866b04550fc5461058c398c2e3e509381ajeffhao kAccFinal | kAccSynchronized | kAccBridge | kAccVarargs | kAccNative | kAccAbstract | 37010037c866b04550fc5461058c398c2e3e509381ajeffhao kAccStrict | kAccSynthetic | kAccConstructor | kAccDeclaredSynchronized; 3718d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(((access_flags & ~access_method_mask) != 0) || 3728d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers (is_synchronized && !allow_synchronized))) { 3738d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad class_data_item method access_flags %x", access_flags); 37410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 37510037c866b04550fc5461058c398c2e3e509381ajeffhao } 37610037c866b04550fc5461058c398c2e3e509381ajeffhao 3778d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(expect_code && (code_offset == 0))) { 3788d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unexpected zero value for class_data_item method code_off with access " 3798d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers "flags %x", access_flags); 38010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 3818d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } else if (UNLIKELY(!expect_code && (code_offset != 0))) { 3828d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unexpected non-zero value %x for class_data_item method code_off" 3838d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers " with access flags %x", code_offset, access_flags); 38410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 38510037c866b04550fc5461058c398c2e3e509381ajeffhao } 38610037c866b04550fc5461058c398c2e3e509381ajeffhao 38710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 38810037c866b04550fc5461058c398c2e3e509381ajeffhao} 38910037c866b04550fc5461058c398c2e3e509381ajeffhao 3908a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckPadding(size_t offset, uint32_t aligned_offset) { 39110037c866b04550fc5461058c398c2e3e509381ajeffhao if (offset < aligned_offset) { 39230fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers if (!CheckPointerRange(begin_ + offset, begin_ + aligned_offset, "section")) { 39310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 39410037c866b04550fc5461058c398c2e3e509381ajeffhao } 39510037c866b04550fc5461058c398c2e3e509381ajeffhao while (offset < aligned_offset) { 3968d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(*ptr_ != '\0')) { 3978a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Non-zero padding %x before section start at %zx", *ptr_, offset); 39810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 39910037c866b04550fc5461058c398c2e3e509381ajeffhao } 40010037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_++; 40110037c866b04550fc5461058c398c2e3e509381ajeffhao offset++; 40210037c866b04550fc5461058c398c2e3e509381ajeffhao } 40310037c866b04550fc5461058c398c2e3e509381ajeffhao } 40410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 40510037c866b04550fc5461058c398c2e3e509381ajeffhao} 40610037c866b04550fc5461058c398c2e3e509381ajeffhao 40710037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckEncodedValue() { 40810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPointerRange(ptr_, ptr_ + 1, "encoded_value header")) { 40910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 41010037c866b04550fc5461058c398c2e3e509381ajeffhao } 41110037c866b04550fc5461058c398c2e3e509381ajeffhao 41210037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t header_byte = *(ptr_++); 41310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t value_type = header_byte & DexFile::kDexAnnotationValueTypeMask; 41410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t value_arg = header_byte >> DexFile::kDexAnnotationValueArgShift; 41510037c866b04550fc5461058c398c2e3e509381ajeffhao 41610037c866b04550fc5461058c398c2e3e509381ajeffhao switch (value_type) { 41710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationByte: 4188d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 4198d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value byte size %x", value_arg); 42010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 42110037c866b04550fc5461058c398c2e3e509381ajeffhao } 42210037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_++; 42310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 42410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationShort: 42510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationChar: 4268d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 1)) { 4278d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value char/short size %x", value_arg); 42810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 42910037c866b04550fc5461058c398c2e3e509381ajeffhao } 43010037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += value_arg + 1; 43110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 43210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationInt: 43310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationFloat: 4348d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 4358d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value int/float size %x", value_arg); 43610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 43710037c866b04550fc5461058c398c2e3e509381ajeffhao } 43810037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += value_arg + 1; 43910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 44010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationLong: 44110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationDouble: 44210037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += value_arg + 1; 44310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 44410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationString: { 4458d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 4468d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value string size %x", value_arg); 44710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 44810037c866b04550fc5461058c398c2e3e509381ajeffhao } 44910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 45010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->string_ids_size_, "encoded_value string")) { 45110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 45210037c866b04550fc5461058c398c2e3e509381ajeffhao } 45310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 45410037c866b04550fc5461058c398c2e3e509381ajeffhao } 45510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationType: { 4568d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 4578d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value type size %x", value_arg); 45810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 45910037c866b04550fc5461058c398c2e3e509381ajeffhao } 46010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 46110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->type_ids_size_, "encoded_value type")) { 46210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 46310037c866b04550fc5461058c398c2e3e509381ajeffhao } 46410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 46510037c866b04550fc5461058c398c2e3e509381ajeffhao } 46610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationField: 46710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationEnum: { 4688d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 4698d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value field/enum size %x", value_arg); 47010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 47110037c866b04550fc5461058c398c2e3e509381ajeffhao } 47210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 47310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->field_ids_size_, "encoded_value field")) { 47410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 47510037c866b04550fc5461058c398c2e3e509381ajeffhao } 47610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 47710037c866b04550fc5461058c398c2e3e509381ajeffhao } 47810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationMethod: { 4798d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 3)) { 4808d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value method size %x", value_arg); 48110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 48210037c866b04550fc5461058c398c2e3e509381ajeffhao } 48310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = ReadUnsignedLittleEndian(value_arg + 1); 48410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->method_ids_size_, "encoded_value method")) { 48510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 48610037c866b04550fc5461058c398c2e3e509381ajeffhao } 48710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 48810037c866b04550fc5461058c398c2e3e509381ajeffhao } 48910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationArray: 4908d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 4918d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value array value_arg %x", value_arg); 49210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 49310037c866b04550fc5461058c398c2e3e509381ajeffhao } 49410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedArray()) { 49510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 49610037c866b04550fc5461058c398c2e3e509381ajeffhao } 49710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 49810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationAnnotation: 4998d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 5008d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value annotation value_arg %x", value_arg); 50110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 50210037c866b04550fc5461058c398c2e3e509381ajeffhao } 50310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedAnnotation()) { 50410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 50510037c866b04550fc5461058c398c2e3e509381ajeffhao } 50610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 50710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationNull: 5088d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg != 0)) { 5098d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value null value_arg %x", value_arg); 51010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 51110037c866b04550fc5461058c398c2e3e509381ajeffhao } 51210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 51310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexAnnotationBoolean: 5148d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value_arg > 1)) { 5158d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad encoded_value boolean size %x", value_arg); 51610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 51710037c866b04550fc5461058c398c2e3e509381ajeffhao } 51810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 51910037c866b04550fc5461058c398c2e3e509381ajeffhao default: 5208d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bogus encoded_value value_type %x", value_type); 52110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 52210037c866b04550fc5461058c398c2e3e509381ajeffhao } 52310037c866b04550fc5461058c398c2e3e509381ajeffhao 52410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 52510037c866b04550fc5461058c398c2e3e509381ajeffhao} 52610037c866b04550fc5461058c398c2e3e509381ajeffhao 52710037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckEncodedArray() { 52810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = DecodeUnsignedLeb128(&ptr_); 52910037c866b04550fc5461058c398c2e3e509381ajeffhao 53010037c866b04550fc5461058c398c2e3e509381ajeffhao while (size--) { 53110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedValue()) { 5328d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers failure_reason_ = StringPrintf("Bad encoded_array value: %s", failure_reason_.c_str()); 53310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 53410037c866b04550fc5461058c398c2e3e509381ajeffhao } 53510037c866b04550fc5461058c398c2e3e509381ajeffhao } 53610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 53710037c866b04550fc5461058c398c2e3e509381ajeffhao} 53810037c866b04550fc5461058c398c2e3e509381ajeffhao 53910037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckEncodedAnnotation() { 54010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = DecodeUnsignedLeb128(&ptr_); 54110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->type_ids_size_, "encoded_annotation type_idx")) { 54210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 54310037c866b04550fc5461058c398c2e3e509381ajeffhao } 54410037c866b04550fc5461058c398c2e3e509381ajeffhao 54510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = DecodeUnsignedLeb128(&ptr_); 54610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_idx = 0; 54710037c866b04550fc5461058c398c2e3e509381ajeffhao 54810037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < size; i++) { 54910037c866b04550fc5461058c398c2e3e509381ajeffhao idx = DecodeUnsignedLeb128(&ptr_); 55010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(idx, header_->string_ids_size_, "annotation_element name_idx")) { 55110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 55210037c866b04550fc5461058c398c2e3e509381ajeffhao } 55310037c866b04550fc5461058c398c2e3e509381ajeffhao 5548d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= idx && i != 0)) { 5558d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order annotation_element name_idx: %x then %x", 5568d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers last_idx, idx); 55710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 55810037c866b04550fc5461058c398c2e3e509381ajeffhao } 55910037c866b04550fc5461058c398c2e3e509381ajeffhao 56010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedValue()) { 56110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 56210037c866b04550fc5461058c398c2e3e509381ajeffhao } 56310037c866b04550fc5461058c398c2e3e509381ajeffhao 56410037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = idx; 56510037c866b04550fc5461058c398c2e3e509381ajeffhao } 56610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 56710037c866b04550fc5461058c398c2e3e509381ajeffhao} 56810037c866b04550fc5461058c398c2e3e509381ajeffhao 56910037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraClassDataItem() { 57010037c866b04550fc5461058c398c2e3e509381ajeffhao ClassDataItemIterator it(*dex_file_, ptr_); 57110037c866b04550fc5461058c398c2e3e509381ajeffhao 57210037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextStaticField(); it.Next()) { 57310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckClassDataItemField(it.GetMemberIndex(), it.GetMemberAccessFlags(), true)) { 57410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 57510037c866b04550fc5461058c398c2e3e509381ajeffhao } 57610037c866b04550fc5461058c398c2e3e509381ajeffhao } 57710037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextInstanceField(); it.Next()) { 57810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckClassDataItemField(it.GetMemberIndex(), it.GetMemberAccessFlags(), false)) { 57910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 58010037c866b04550fc5461058c398c2e3e509381ajeffhao } 58110037c866b04550fc5461058c398c2e3e509381ajeffhao } 58210037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextDirectMethod(); it.Next()) { 58310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckClassDataItemMethod(it.GetMemberIndex(), it.GetMemberAccessFlags(), 58410037c866b04550fc5461058c398c2e3e509381ajeffhao it.GetMethodCodeItemOffset(), true)) { 58510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 58610037c866b04550fc5461058c398c2e3e509381ajeffhao } 58710037c866b04550fc5461058c398c2e3e509381ajeffhao } 58810037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextVirtualMethod(); it.Next()) { 58910037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckClassDataItemMethod(it.GetMemberIndex(), it.GetMemberAccessFlags(), 59010037c866b04550fc5461058c398c2e3e509381ajeffhao it.GetMethodCodeItemOffset(), false)) { 59110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 59210037c866b04550fc5461058c398c2e3e509381ajeffhao } 59310037c866b04550fc5461058c398c2e3e509381ajeffhao } 59410037c866b04550fc5461058c398c2e3e509381ajeffhao 59510037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = it.EndDataPointer(); 59610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 59710037c866b04550fc5461058c398c2e3e509381ajeffhao} 59810037c866b04550fc5461058c398c2e3e509381ajeffhao 59910037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraCodeItem() { 60010037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::CodeItem* code_item = reinterpret_cast<const DexFile::CodeItem*>(ptr_); 60110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPointerRange(code_item, code_item + 1, "code")) { 60210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 60310037c866b04550fc5461058c398c2e3e509381ajeffhao } 60410037c866b04550fc5461058c398c2e3e509381ajeffhao 6058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(code_item->ins_size_ > code_item->registers_size_)) { 6068d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("ins_size (%ud) > registers_size (%ud)", 6078d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers code_item->ins_size_, code_item->registers_size_); 60810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 60910037c866b04550fc5461058c398c2e3e509381ajeffhao } 61010037c866b04550fc5461058c398c2e3e509381ajeffhao 6118d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((code_item->outs_size_ > 5) && 6128d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers (code_item->outs_size_ > code_item->registers_size_))) { 61310037c866b04550fc5461058c398c2e3e509381ajeffhao /* 61410037c866b04550fc5461058c398c2e3e509381ajeffhao * outs_size can be up to 5, even if registers_size is smaller, since the 61510037c866b04550fc5461058c398c2e3e509381ajeffhao * short forms of method invocation allow repetitions of a register multiple 61610037c866b04550fc5461058c398c2e3e509381ajeffhao * times within a single parameter list. However, longer parameter lists 61710037c866b04550fc5461058c398c2e3e509381ajeffhao * need to be represented in-order in the register file. 61810037c866b04550fc5461058c398c2e3e509381ajeffhao */ 6198d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("outs_size (%ud) > registers_size (%ud)", 6208d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers code_item->outs_size_, code_item->registers_size_); 62110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 62210037c866b04550fc5461058c398c2e3e509381ajeffhao } 62310037c866b04550fc5461058c398c2e3e509381ajeffhao 62410037c866b04550fc5461058c398c2e3e509381ajeffhao const uint16_t* insns = code_item->insns_; 62510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t insns_size = code_item->insns_size_in_code_units_; 62610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(insns, insns_size, sizeof(uint16_t), "insns size")) { 62710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 62810037c866b04550fc5461058c398c2e3e509381ajeffhao } 62910037c866b04550fc5461058c398c2e3e509381ajeffhao 63010037c866b04550fc5461058c398c2e3e509381ajeffhao // Grab the end of the insns if there are no try_items. 63110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t try_items_size = code_item->tries_size_; 63210037c866b04550fc5461058c398c2e3e509381ajeffhao if (try_items_size == 0) { 63310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = reinterpret_cast<const byte*>(&insns[insns_size]); 63410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 63510037c866b04550fc5461058c398c2e3e509381ajeffhao } 63610037c866b04550fc5461058c398c2e3e509381ajeffhao 63710037c866b04550fc5461058c398c2e3e509381ajeffhao // try_items are 4-byte aligned. Verify the spacer is 0. 6388a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers if (((reinterpret_cast<uintptr_t>(&insns[insns_size]) & 3) != 0) && (insns[insns_size] != 0)) { 6398d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Non-zero padding: %x", insns[insns_size]); 64010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 64110037c866b04550fc5461058c398c2e3e509381ajeffhao } 64210037c866b04550fc5461058c398c2e3e509381ajeffhao 64310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TryItem* try_items = DexFile::GetTryItems(*code_item, 0); 64410037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = DexFile::GetCatchHandlerData(*code_item, 0); 64510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t handlers_size = DecodeUnsignedLeb128(&ptr_); 64610037c866b04550fc5461058c398c2e3e509381ajeffhao 64710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(try_items, try_items_size, sizeof(DexFile::TryItem), "try_items size")) { 64810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 64910037c866b04550fc5461058c398c2e3e509381ajeffhao } 65010037c866b04550fc5461058c398c2e3e509381ajeffhao 6518d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((handlers_size == 0) || (handlers_size >= 65536))) { 6528d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid handlers_size: %ud", handlers_size); 65310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 65410037c866b04550fc5461058c398c2e3e509381ajeffhao } 65510037c866b04550fc5461058c398c2e3e509381ajeffhao 656700a402244a1a423da4f3ba8032459f4b65fa18fIan Rogers std::unique_ptr<uint32_t[]> handler_offsets(new uint32_t[handlers_size]); 657ee0fa76b2e5d39ad36d1ff144b2d0270df81e606Elliott Hughes if (!CheckAndGetHandlerOffsets(code_item, &handler_offsets[0], handlers_size)) { 65810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 65910037c866b04550fc5461058c398c2e3e509381ajeffhao } 66010037c866b04550fc5461058c398c2e3e509381ajeffhao 66110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_addr = 0; 66210037c866b04550fc5461058c398c2e3e509381ajeffhao while (try_items_size--) { 6638d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(try_items->start_addr_ < last_addr)) { 6648d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of_order try_item with start_addr: %x", try_items->start_addr_); 66510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 66610037c866b04550fc5461058c398c2e3e509381ajeffhao } 66710037c866b04550fc5461058c398c2e3e509381ajeffhao 6688d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(try_items->start_addr_ >= insns_size)) { 6698d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid try_item start_addr: %x", try_items->start_addr_); 67010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 67110037c866b04550fc5461058c398c2e3e509381ajeffhao } 67210037c866b04550fc5461058c398c2e3e509381ajeffhao 67310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t i; 67410037c866b04550fc5461058c398c2e3e509381ajeffhao for (i = 0; i < handlers_size; i++) { 67510037c866b04550fc5461058c398c2e3e509381ajeffhao if (try_items->handler_off_ == handler_offsets[i]) { 67610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 67710037c866b04550fc5461058c398c2e3e509381ajeffhao } 67810037c866b04550fc5461058c398c2e3e509381ajeffhao } 67910037c866b04550fc5461058c398c2e3e509381ajeffhao 6808d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(i == handlers_size)) { 6818d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bogus handler offset: %x", try_items->handler_off_); 68210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 68310037c866b04550fc5461058c398c2e3e509381ajeffhao } 68410037c866b04550fc5461058c398c2e3e509381ajeffhao 68510037c866b04550fc5461058c398c2e3e509381ajeffhao last_addr = try_items->start_addr_ + try_items->insn_count_; 6868d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_addr > insns_size)) { 6878d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid try_item insn_count: %x", try_items->insn_count_); 68810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 68910037c866b04550fc5461058c398c2e3e509381ajeffhao } 69010037c866b04550fc5461058c398c2e3e509381ajeffhao 69110037c866b04550fc5461058c398c2e3e509381ajeffhao try_items++; 69210037c866b04550fc5461058c398c2e3e509381ajeffhao } 69310037c866b04550fc5461058c398c2e3e509381ajeffhao 69410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 69510037c866b04550fc5461058c398c2e3e509381ajeffhao} 69610037c866b04550fc5461058c398c2e3e509381ajeffhao 69710037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraStringDataItem() { 69810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = DecodeUnsignedLeb128(&ptr_); 699f6174e8a1566bb357e82506f7ec97dc359c90eb2jeffhao const byte* file_end = begin_ + size_; 70010037c866b04550fc5461058c398c2e3e509381ajeffhao 70110037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < size; i++) { 702c647564845429bd709ed3338c13f15063c2f9fd9Brian Carlstrom CHECK_LT(i, size); // b/15014252 Prevents hitting the impossible case below 7038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(ptr_ >= file_end)) { 7048d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("String data would go beyond end-of-file"); 70510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 70610037c866b04550fc5461058c398c2e3e509381ajeffhao } 70710037c866b04550fc5461058c398c2e3e509381ajeffhao 70810037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte = *(ptr_++); 70910037c866b04550fc5461058c398c2e3e509381ajeffhao 71010037c866b04550fc5461058c398c2e3e509381ajeffhao // Switch on the high 4 bits. 71110037c866b04550fc5461058c398c2e3e509381ajeffhao switch (byte >> 4) { 71210037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x00: 71310037c866b04550fc5461058c398c2e3e509381ajeffhao // Special case of bit pattern 0xxx. 7148d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(byte == 0)) { 715c647564845429bd709ed3338c13f15063c2f9fd9Brian Carlstrom CHECK_LT(i, size); // b/15014252 Actually hit this impossible case with clang 7168d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("String data shorter than indicated utf16_size %x", size); 71710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 71810037c866b04550fc5461058c398c2e3e509381ajeffhao } 71910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 72010037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x01: 72110037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x02: 72210037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x03: 72310037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x04: 72410037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x05: 72510037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x06: 72610037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x07: 72710037c866b04550fc5461058c398c2e3e509381ajeffhao // No extra checks necessary for bit pattern 0xxx. 72810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 72910037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x08: 73010037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x09: 73110037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0a: 73210037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0b: 73310037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0f: 73410037c866b04550fc5461058c398c2e3e509381ajeffhao // Illegal bit patterns 10xx or 1111. 73510037c866b04550fc5461058c398c2e3e509381ajeffhao // Note: 1111 is valid for normal UTF-8, but not here. 7368d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal start byte %x in string data", byte); 73710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 73810037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0c: 73910037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0d: { 74010037c866b04550fc5461058c398c2e3e509381ajeffhao // Bit pattern 110x has an additional byte. 74110037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte2 = *(ptr_++); 7428d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((byte2 & 0xc0) != 0x80)) { 7438d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal continuation byte %x in string data", byte2); 74410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 74510037c866b04550fc5461058c398c2e3e509381ajeffhao } 74610037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t value = ((byte & 0x1f) << 6) | (byte2 & 0x3f); 7478d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((value != 0) && (value < 0x80))) { 7488d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal representation for value %x in string data", value); 74910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 75010037c866b04550fc5461058c398c2e3e509381ajeffhao } 75110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 75210037c866b04550fc5461058c398c2e3e509381ajeffhao } 75310037c866b04550fc5461058c398c2e3e509381ajeffhao case 0x0e: { 75410037c866b04550fc5461058c398c2e3e509381ajeffhao // Bit pattern 1110 has 2 additional bytes. 75510037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte2 = *(ptr_++); 7568d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((byte2 & 0xc0) != 0x80)) { 7578d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal continuation byte %x in string data", byte2); 75810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 75910037c866b04550fc5461058c398c2e3e509381ajeffhao } 76010037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t byte3 = *(ptr_++); 7618d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((byte3 & 0xc0) != 0x80)) { 7628d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal continuation byte %x in string data", byte3); 76310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 76410037c866b04550fc5461058c398c2e3e509381ajeffhao } 76510037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t value = ((byte & 0x0f) << 12) | ((byte2 & 0x3f) << 6) | (byte3 & 0x3f); 7668d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(value < 0x800)) { 7678d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Illegal representation for value %x in string data", value); 76810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 76910037c866b04550fc5461058c398c2e3e509381ajeffhao } 77010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 77110037c866b04550fc5461058c398c2e3e509381ajeffhao } 77210037c866b04550fc5461058c398c2e3e509381ajeffhao } 77310037c866b04550fc5461058c398c2e3e509381ajeffhao } 77410037c866b04550fc5461058c398c2e3e509381ajeffhao 7758d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(*(ptr_++) != '\0')) { 7768d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("String longer than indicated size %x", size); 77710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 77810037c866b04550fc5461058c398c2e3e509381ajeffhao } 77910037c866b04550fc5461058c398c2e3e509381ajeffhao 78010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 78110037c866b04550fc5461058c398c2e3e509381ajeffhao} 78210037c866b04550fc5461058c398c2e3e509381ajeffhao 78310037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraDebugInfoItem() { 78410037c866b04550fc5461058c398c2e3e509381ajeffhao DecodeUnsignedLeb128(&ptr_); 78510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameters_size = DecodeUnsignedLeb128(&ptr_); 7868d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(parameters_size > 65536)) { 7878d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid parameters_size: %x", parameters_size); 78810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 78910037c866b04550fc5461058c398c2e3e509381ajeffhao } 79010037c866b04550fc5461058c398c2e3e509381ajeffhao 79110037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t j = 0; j < parameters_size; j++) { 79210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameter_name = DecodeUnsignedLeb128(&ptr_); 79310037c866b04550fc5461058c398c2e3e509381ajeffhao if (parameter_name != 0) { 79410037c866b04550fc5461058c398c2e3e509381ajeffhao parameter_name--; 79510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(parameter_name, header_->string_ids_size_, "debug_info_item parameter_name")) { 79610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 79710037c866b04550fc5461058c398c2e3e509381ajeffhao } 79810037c866b04550fc5461058c398c2e3e509381ajeffhao } 79910037c866b04550fc5461058c398c2e3e509381ajeffhao } 80010037c866b04550fc5461058c398c2e3e509381ajeffhao 80110037c866b04550fc5461058c398c2e3e509381ajeffhao while (true) { 80210037c866b04550fc5461058c398c2e3e509381ajeffhao uint8_t opcode = *(ptr_++); 80310037c866b04550fc5461058c398c2e3e509381ajeffhao switch (opcode) { 80410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_END_SEQUENCE: { 80510037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 80610037c866b04550fc5461058c398c2e3e509381ajeffhao } 80710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_ADVANCE_PC: { 80810037c866b04550fc5461058c398c2e3e509381ajeffhao DecodeUnsignedLeb128(&ptr_); 80910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 81010037c866b04550fc5461058c398c2e3e509381ajeffhao } 81110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_ADVANCE_LINE: { 81210037c866b04550fc5461058c398c2e3e509381ajeffhao DecodeSignedLeb128(&ptr_); 81310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 81410037c866b04550fc5461058c398c2e3e509381ajeffhao } 81510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_START_LOCAL: { 81610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t reg_num = DecodeUnsignedLeb128(&ptr_); 8178d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(reg_num >= 65536)) { 8188d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad reg_num for opcode %x", opcode); 81910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 82010037c866b04550fc5461058c398c2e3e509381ajeffhao } 82110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t name_idx = DecodeUnsignedLeb128(&ptr_); 82210037c866b04550fc5461058c398c2e3e509381ajeffhao if (name_idx != 0) { 82310037c866b04550fc5461058c398c2e3e509381ajeffhao name_idx--; 82410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(name_idx, header_->string_ids_size_, "DBG_START_LOCAL name_idx")) { 82510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 82610037c866b04550fc5461058c398c2e3e509381ajeffhao } 82710037c866b04550fc5461058c398c2e3e509381ajeffhao } 82810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t type_idx = DecodeUnsignedLeb128(&ptr_); 82910037c866b04550fc5461058c398c2e3e509381ajeffhao if (type_idx != 0) { 83010037c866b04550fc5461058c398c2e3e509381ajeffhao type_idx--; 83110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(type_idx, header_->string_ids_size_, "DBG_START_LOCAL type_idx")) { 83210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 83310037c866b04550fc5461058c398c2e3e509381ajeffhao } 83410037c866b04550fc5461058c398c2e3e509381ajeffhao } 83510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 83610037c866b04550fc5461058c398c2e3e509381ajeffhao } 83710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_END_LOCAL: 83810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_RESTART_LOCAL: { 83910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t reg_num = DecodeUnsignedLeb128(&ptr_); 8408d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(reg_num >= 65536)) { 8418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad reg_num for opcode %x", opcode); 84210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 84310037c866b04550fc5461058c398c2e3e509381ajeffhao } 84410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 84510037c866b04550fc5461058c398c2e3e509381ajeffhao } 84610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_START_LOCAL_EXTENDED: { 84710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t reg_num = DecodeUnsignedLeb128(&ptr_); 8488d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(reg_num >= 65536)) { 8498d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad reg_num for opcode %x", opcode); 85010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 85110037c866b04550fc5461058c398c2e3e509381ajeffhao } 85210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t name_idx = DecodeUnsignedLeb128(&ptr_); 85310037c866b04550fc5461058c398c2e3e509381ajeffhao if (name_idx != 0) { 85410037c866b04550fc5461058c398c2e3e509381ajeffhao name_idx--; 85510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(name_idx, header_->string_ids_size_, "DBG_START_LOCAL_EXTENDED name_idx")) { 85610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 85710037c866b04550fc5461058c398c2e3e509381ajeffhao } 85810037c866b04550fc5461058c398c2e3e509381ajeffhao } 85910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t type_idx = DecodeUnsignedLeb128(&ptr_); 86010037c866b04550fc5461058c398c2e3e509381ajeffhao if (type_idx != 0) { 86110037c866b04550fc5461058c398c2e3e509381ajeffhao type_idx--; 86210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(type_idx, header_->string_ids_size_, "DBG_START_LOCAL_EXTENDED type_idx")) { 86310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 86410037c866b04550fc5461058c398c2e3e509381ajeffhao } 86510037c866b04550fc5461058c398c2e3e509381ajeffhao } 86610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t sig_idx = DecodeUnsignedLeb128(&ptr_); 86710037c866b04550fc5461058c398c2e3e509381ajeffhao if (sig_idx != 0) { 86810037c866b04550fc5461058c398c2e3e509381ajeffhao sig_idx--; 86910037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(sig_idx, header_->string_ids_size_, "DBG_START_LOCAL_EXTENDED sig_idx")) { 87010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 87110037c866b04550fc5461058c398c2e3e509381ajeffhao } 87210037c866b04550fc5461058c398c2e3e509381ajeffhao } 87310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 87410037c866b04550fc5461058c398c2e3e509381ajeffhao } 87510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::DBG_SET_FILE: { 87610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t name_idx = DecodeUnsignedLeb128(&ptr_); 87710037c866b04550fc5461058c398c2e3e509381ajeffhao if (name_idx != 0) { 87810037c866b04550fc5461058c398c2e3e509381ajeffhao name_idx--; 87910037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIndex(name_idx, header_->string_ids_size_, "DBG_SET_FILE name_idx")) { 88010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 88110037c866b04550fc5461058c398c2e3e509381ajeffhao } 88210037c866b04550fc5461058c398c2e3e509381ajeffhao } 88310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 88410037c866b04550fc5461058c398c2e3e509381ajeffhao } 88510037c866b04550fc5461058c398c2e3e509381ajeffhao } 88610037c866b04550fc5461058c398c2e3e509381ajeffhao } 88710037c866b04550fc5461058c398c2e3e509381ajeffhao} 88810037c866b04550fc5461058c398c2e3e509381ajeffhao 88910037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraAnnotationItem() { 89010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPointerRange(ptr_, ptr_ + 1, "annotation visibility")) { 89110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 89210037c866b04550fc5461058c398c2e3e509381ajeffhao } 89310037c866b04550fc5461058c398c2e3e509381ajeffhao 89410037c866b04550fc5461058c398c2e3e509381ajeffhao // Check visibility 89510037c866b04550fc5461058c398c2e3e509381ajeffhao switch (*(ptr_++)) { 89610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexVisibilityBuild: 89710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexVisibilityRuntime: 89810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexVisibilitySystem: 89910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 90010037c866b04550fc5461058c398c2e3e509381ajeffhao default: 9018d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad annotation visibility: %x", *ptr_); 90210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 90310037c866b04550fc5461058c398c2e3e509381ajeffhao } 90410037c866b04550fc5461058c398c2e3e509381ajeffhao 90510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedAnnotation()) { 90610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 90710037c866b04550fc5461058c398c2e3e509381ajeffhao } 90810037c866b04550fc5461058c398c2e3e509381ajeffhao 90910037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 91010037c866b04550fc5461058c398c2e3e509381ajeffhao} 91110037c866b04550fc5461058c398c2e3e509381ajeffhao 91210037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraAnnotationsDirectoryItem() { 91310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationsDirectoryItem* item = 91410037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationsDirectoryItem*>(ptr_); 91510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPointerRange(item, item + 1, "annotations_directory")) { 91610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 91710037c866b04550fc5461058c398c2e3e509381ajeffhao } 91810037c866b04550fc5461058c398c2e3e509381ajeffhao 91910037c866b04550fc5461058c398c2e3e509381ajeffhao // Field annotations follow immediately after the annotations directory. 92010037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldAnnotationsItem* field_item = 92110037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::FieldAnnotationsItem*>(item + 1); 92210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t field_count = item->fields_size_; 92310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(field_item, field_count, sizeof(DexFile::FieldAnnotationsItem), "field_annotations list")) { 92410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 92510037c866b04550fc5461058c398c2e3e509381ajeffhao } 92610037c866b04550fc5461058c398c2e3e509381ajeffhao 92710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_idx = 0; 92810037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < field_count; i++) { 9298d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= field_item->field_idx_ && i != 0)) { 9308d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_idx for annotation: %x then %x", last_idx, field_item->field_idx_); 93110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 93210037c866b04550fc5461058c398c2e3e509381ajeffhao } 93310037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = field_item->field_idx_; 93410037c866b04550fc5461058c398c2e3e509381ajeffhao field_item++; 93510037c866b04550fc5461058c398c2e3e509381ajeffhao } 93610037c866b04550fc5461058c398c2e3e509381ajeffhao 93710037c866b04550fc5461058c398c2e3e509381ajeffhao // Method annotations follow immediately after field annotations. 93810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodAnnotationsItem* method_item = 93910037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::MethodAnnotationsItem*>(field_item); 94010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t method_count = item->methods_size_; 94110037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckListSize(method_item, method_count, sizeof(DexFile::MethodAnnotationsItem), "method_annotations list")) { 94210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 94310037c866b04550fc5461058c398c2e3e509381ajeffhao } 94410037c866b04550fc5461058c398c2e3e509381ajeffhao 94510037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = 0; 94610037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < method_count; i++) { 9478d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= method_item->method_idx_ && i != 0)) { 9488d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_idx for annotation: %x then %x", 9498d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers last_idx, method_item->method_idx_); 95010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 95110037c866b04550fc5461058c398c2e3e509381ajeffhao } 95210037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = method_item->method_idx_; 95310037c866b04550fc5461058c398c2e3e509381ajeffhao method_item++; 95410037c866b04550fc5461058c398c2e3e509381ajeffhao } 95510037c866b04550fc5461058c398c2e3e509381ajeffhao 95610037c866b04550fc5461058c398c2e3e509381ajeffhao // Parameter annotations follow immediately after method annotations. 95710037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ParameterAnnotationsItem* parameter_item = 95810037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::ParameterAnnotationsItem*>(method_item); 95910037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameter_count = item->parameters_size_; 9602b87ddf36abff711fa2233c49bffc7ceb03b15d7Dragos Sbirlea if (!CheckListSize(parameter_item, parameter_count, sizeof(DexFile::ParameterAnnotationsItem), 9618d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers "parameter_annotations list")) { 96210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 96310037c866b04550fc5461058c398c2e3e509381ajeffhao } 96410037c866b04550fc5461058c398c2e3e509381ajeffhao 96510037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = 0; 96610037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < parameter_count; i++) { 9678d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= parameter_item->method_idx_ && i != 0)) { 9688d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_idx for annotation: %x then %x", 9698d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers last_idx, parameter_item->method_idx_); 97010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 97110037c866b04550fc5461058c398c2e3e509381ajeffhao } 97210037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = parameter_item->method_idx_; 97310037c866b04550fc5461058c398c2e3e509381ajeffhao parameter_item++; 97410037c866b04550fc5461058c398c2e3e509381ajeffhao } 97510037c866b04550fc5461058c398c2e3e509381ajeffhao 97610037c866b04550fc5461058c398c2e3e509381ajeffhao // Return a pointer to the end of the annotations. 97710037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = reinterpret_cast<const byte*>(parameter_item); 97810037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 97910037c866b04550fc5461058c398c2e3e509381ajeffhao} 98010037c866b04550fc5461058c398c2e3e509381ajeffhao 9818a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckIntraSectionIterate(size_t offset, uint32_t count, uint16_t type) { 98210037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the right alignment mask for the type of section. 9838a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t alignment_mask; 98410037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 98510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 98610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: 98710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: 98810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: 98910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: 99010037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint8_t) - 1; 99110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 99210037c866b04550fc5461058c398c2e3e509381ajeffhao default: 99310037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint32_t) - 1; 99410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 99510037c866b04550fc5461058c398c2e3e509381ajeffhao } 99610037c866b04550fc5461058c398c2e3e509381ajeffhao 99710037c866b04550fc5461058c398c2e3e509381ajeffhao // Iterate through the items in the section. 99810037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < count; i++) { 9998a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t aligned_offset = (offset + alignment_mask) & ~alignment_mask; 100010037c866b04550fc5461058c398c2e3e509381ajeffhao 100110037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the padding between items. 100210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPadding(offset, aligned_offset)) { 100310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 100410037c866b04550fc5461058c398c2e3e509381ajeffhao } 100510037c866b04550fc5461058c398c2e3e509381ajeffhao 100610037c866b04550fc5461058c398c2e3e509381ajeffhao // Check depending on the section type. 100710037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 100810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: { 100910037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPointerRange(ptr_, ptr_ + sizeof(DexFile::StringId), "string_ids")) { 101010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 101110037c866b04550fc5461058c398c2e3e509381ajeffhao } 101210037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::StringId); 101310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 101410037c866b04550fc5461058c398c2e3e509381ajeffhao } 101510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: { 101610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPointerRange(ptr_, ptr_ + sizeof(DexFile::TypeId), "type_ids")) { 101710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 101810037c866b04550fc5461058c398c2e3e509381ajeffhao } 101910037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::TypeId); 102010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 102110037c866b04550fc5461058c398c2e3e509381ajeffhao } 102210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: { 102310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPointerRange(ptr_, ptr_ + sizeof(DexFile::ProtoId), "proto_ids")) { 102410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 102510037c866b04550fc5461058c398c2e3e509381ajeffhao } 102610037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ProtoId); 102710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 102810037c866b04550fc5461058c398c2e3e509381ajeffhao } 102910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: { 103010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPointerRange(ptr_, ptr_ + sizeof(DexFile::FieldId), "field_ids")) { 103110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 103210037c866b04550fc5461058c398c2e3e509381ajeffhao } 103310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::FieldId); 103410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 103510037c866b04550fc5461058c398c2e3e509381ajeffhao } 103610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: { 103710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPointerRange(ptr_, ptr_ + sizeof(DexFile::MethodId), "method_ids")) { 103810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 103910037c866b04550fc5461058c398c2e3e509381ajeffhao } 104010037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::MethodId); 104110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 104210037c866b04550fc5461058c398c2e3e509381ajeffhao } 104310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: { 104410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPointerRange(ptr_, ptr_ + sizeof(DexFile::ClassDef), "class_defs")) { 104510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 104610037c866b04550fc5461058c398c2e3e509381ajeffhao } 104710037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ClassDef); 104810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 104910037c866b04550fc5461058c398c2e3e509381ajeffhao } 105010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: { 105110037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TypeList* list = reinterpret_cast<const DexFile::TypeList*>(ptr_); 105210037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TypeItem* item = &list->GetTypeItem(0); 105310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = list->Size(); 105410037c866b04550fc5461058c398c2e3e509381ajeffhao 105510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPointerRange(list, list + 1, "type_list") || 105610037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckListSize(item, count, sizeof(DexFile::TypeItem), "type_list size")) { 105710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 105810037c866b04550fc5461058c398c2e3e509381ajeffhao } 105910037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = reinterpret_cast<const byte*>(item + count); 106010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 106110037c866b04550fc5461058c398c2e3e509381ajeffhao } 106210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: { 106310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationSetRefList* list = 106410037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationSetRefList*>(ptr_); 106510037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationSetRefItem* item = list->list_; 106610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = list->size_; 106710037c866b04550fc5461058c398c2e3e509381ajeffhao 106810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPointerRange(list, list + 1, "annotation_set_ref_list") || 10692b87ddf36abff711fa2233c49bffc7ceb03b15d7Dragos Sbirlea !CheckListSize(item, count, sizeof(DexFile::AnnotationSetRefItem), 10708d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers "annotation_set_ref_list size")) { 107110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 107210037c866b04550fc5461058c398c2e3e509381ajeffhao } 107310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = reinterpret_cast<const byte*>(item + count); 107410037c866b04550fc5461058c398c2e3e509381ajeffhao break; 107510037c866b04550fc5461058c398c2e3e509381ajeffhao } 107610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: { 107710037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationSetItem* set = 107810037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationSetItem*>(ptr_); 107910037c866b04550fc5461058c398c2e3e509381ajeffhao const uint32_t* item = set->entries_; 108010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = set->size_; 108110037c866b04550fc5461058c398c2e3e509381ajeffhao 108210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPointerRange(set, set + 1, "annotation_set_item") || 108310037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckListSize(item, count, sizeof(uint32_t), "annotation_set_item size")) { 108410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 108510037c866b04550fc5461058c398c2e3e509381ajeffhao } 108610037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = reinterpret_cast<const byte*>(item + count); 108710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 108810037c866b04550fc5461058c398c2e3e509381ajeffhao } 108910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: { 109010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraClassDataItem()) { 109110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 109210037c866b04550fc5461058c398c2e3e509381ajeffhao } 109310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 109410037c866b04550fc5461058c398c2e3e509381ajeffhao } 109510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: { 109610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraCodeItem()) { 109710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 109810037c866b04550fc5461058c398c2e3e509381ajeffhao } 109910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 110010037c866b04550fc5461058c398c2e3e509381ajeffhao } 110110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: { 110210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraStringDataItem()) { 110310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 110410037c866b04550fc5461058c398c2e3e509381ajeffhao } 110510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 110610037c866b04550fc5461058c398c2e3e509381ajeffhao } 110710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: { 110810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraDebugInfoItem()) { 110910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 111010037c866b04550fc5461058c398c2e3e509381ajeffhao } 111110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 111210037c866b04550fc5461058c398c2e3e509381ajeffhao } 111310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: { 111410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraAnnotationItem()) { 111510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 111610037c866b04550fc5461058c398c2e3e509381ajeffhao } 111710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 111810037c866b04550fc5461058c398c2e3e509381ajeffhao } 111910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: { 112010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckEncodedArray()) { 112110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 112210037c866b04550fc5461058c398c2e3e509381ajeffhao } 112310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 112410037c866b04550fc5461058c398c2e3e509381ajeffhao } 112510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: { 112610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraAnnotationsDirectoryItem()) { 112710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 112810037c866b04550fc5461058c398c2e3e509381ajeffhao } 112910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 113010037c866b04550fc5461058c398c2e3e509381ajeffhao } 113110037c866b04550fc5461058c398c2e3e509381ajeffhao default: 11328d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 113310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 113410037c866b04550fc5461058c398c2e3e509381ajeffhao } 113510037c866b04550fc5461058c398c2e3e509381ajeffhao 113610037c866b04550fc5461058c398c2e3e509381ajeffhao if (IsDataSectionType(type)) { 1137a0e180632411f7fe0edf454e571c42209ee7b540Elliott Hughes offset_to_type_map_.Put(aligned_offset, type); 113810037c866b04550fc5461058c398c2e3e509381ajeffhao } 113910037c866b04550fc5461058c398c2e3e509381ajeffhao 11408a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers aligned_offset = ptr_ - begin_; 11418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(aligned_offset > size_)) { 11428d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Item %d at ends out of bounds", i); 114310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 114410037c866b04550fc5461058c398c2e3e509381ajeffhao } 114510037c866b04550fc5461058c398c2e3e509381ajeffhao 114610037c866b04550fc5461058c398c2e3e509381ajeffhao offset = aligned_offset; 114710037c866b04550fc5461058c398c2e3e509381ajeffhao } 114810037c866b04550fc5461058c398c2e3e509381ajeffhao 114910037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 115010037c866b04550fc5461058c398c2e3e509381ajeffhao} 115110037c866b04550fc5461058c398c2e3e509381ajeffhao 11528a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckIntraIdSection(size_t offset, uint32_t count, uint16_t type) { 115310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t expected_offset; 115410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t expected_size; 115510037c866b04550fc5461058c398c2e3e509381ajeffhao 115610037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the expected offset and size from the header. 115710037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 115810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 115910037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->string_ids_off_; 116010037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->string_ids_size_; 116110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 116210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 116310037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->type_ids_off_; 116410037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->type_ids_size_; 116510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 116610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 116710037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->proto_ids_off_; 116810037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->proto_ids_size_; 116910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 117010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 117110037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->field_ids_off_; 117210037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->field_ids_size_; 117310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 117410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 117510037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->method_ids_off_; 117610037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->method_ids_size_; 117710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 117810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 117910037c866b04550fc5461058c398c2e3e509381ajeffhao expected_offset = header_->class_defs_off_; 118010037c866b04550fc5461058c398c2e3e509381ajeffhao expected_size = header_->class_defs_size_; 118110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 118210037c866b04550fc5461058c398c2e3e509381ajeffhao default: 11838d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad type for id section: %x", type); 118410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 118510037c866b04550fc5461058c398c2e3e509381ajeffhao } 118610037c866b04550fc5461058c398c2e3e509381ajeffhao 118710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the offset and size are what were expected from the header. 11888d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(offset != expected_offset)) { 11898a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Bad offset for section: got %zx, expected %x", offset, expected_offset); 119010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 119110037c866b04550fc5461058c398c2e3e509381ajeffhao } 11928d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(count != expected_size)) { 11938d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Bad size for section: got %x, expected %x", count, expected_size); 119410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 119510037c866b04550fc5461058c398c2e3e509381ajeffhao } 119610037c866b04550fc5461058c398c2e3e509381ajeffhao 119710037c866b04550fc5461058c398c2e3e509381ajeffhao return CheckIntraSectionIterate(offset, count, type); 119810037c866b04550fc5461058c398c2e3e509381ajeffhao} 119910037c866b04550fc5461058c398c2e3e509381ajeffhao 12008a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckIntraDataSection(size_t offset, uint32_t count, uint16_t type) { 12018a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t data_start = header_->data_off_; 12028a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t data_end = data_start + header_->data_size_; 120310037c866b04550fc5461058c398c2e3e509381ajeffhao 120410037c866b04550fc5461058c398c2e3e509381ajeffhao // Sanity check the offset of the section. 12058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((offset < data_start) || (offset > data_end))) { 12068a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Bad offset for data subsection: %zx", offset); 120710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 120810037c866b04550fc5461058c398c2e3e509381ajeffhao } 120910037c866b04550fc5461058c398c2e3e509381ajeffhao 121010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraSectionIterate(offset, count, type)) { 121110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 121210037c866b04550fc5461058c398c2e3e509381ajeffhao } 121310037c866b04550fc5461058c398c2e3e509381ajeffhao 12148a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t next_offset = ptr_ - begin_; 121510037c866b04550fc5461058c398c2e3e509381ajeffhao if (next_offset > data_end) { 12168a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Out-of-bounds end of data subsection: %zx", next_offset); 121710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 121810037c866b04550fc5461058c398c2e3e509381ajeffhao } 121910037c866b04550fc5461058c398c2e3e509381ajeffhao 122010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 122110037c866b04550fc5461058c398c2e3e509381ajeffhao} 122210037c866b04550fc5461058c398c2e3e509381ajeffhao 122310037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckIntraSection() { 122430fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers const DexFile::MapList* map = reinterpret_cast<const DexFile::MapList*>(begin_ + header_->map_off_); 122510037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MapItem* item = map->list_; 122610037c866b04550fc5461058c398c2e3e509381ajeffhao 122710037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = map->size_; 12288a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t offset = 0; 122930fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers ptr_ = begin_; 123010037c866b04550fc5461058c398c2e3e509381ajeffhao 123110037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the items listed in the map. 123210037c866b04550fc5461058c398c2e3e509381ajeffhao while (count--) { 123310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_offset = item->offset_; 123410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_count = item->size_; 123510037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t type = item->type_; 123610037c866b04550fc5461058c398c2e3e509381ajeffhao 123710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check for padding and overlap between items. 123810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckPadding(offset, section_offset)) { 123910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 12408d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } else if (UNLIKELY(offset > section_offset)) { 12418a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Section overlap or out-of-order map: %zx, %x", offset, section_offset); 124210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 124310037c866b04550fc5461058c398c2e3e509381ajeffhao } 124410037c866b04550fc5461058c398c2e3e509381ajeffhao 124510037c866b04550fc5461058c398c2e3e509381ajeffhao // Check each item based on its type. 124610037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 124710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: 12488d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_count != 1)) { 12498d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Multiple header items"); 125010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 125110037c866b04550fc5461058c398c2e3e509381ajeffhao } 12528d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_offset != 0)) { 12538d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Header at %x, not at start of file", section_offset); 125410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 125510037c866b04550fc5461058c398c2e3e509381ajeffhao } 125630fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers ptr_ = begin_ + header_->header_size_; 125710037c866b04550fc5461058c398c2e3e509381ajeffhao offset = header_->header_size_; 125810037c866b04550fc5461058c398c2e3e509381ajeffhao break; 125910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 126010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 126110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 126210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 126310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 126410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 126510037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraIdSection(section_offset, section_count, type)) { 126610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 126710037c866b04550fc5461058c398c2e3e509381ajeffhao } 12688a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers offset = ptr_ - begin_; 126910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 127010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMapList: 12718d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_count != 1)) { 12728d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Multiple map list items"); 127310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 127410037c866b04550fc5461058c398c2e3e509381ajeffhao } 12758d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(section_offset != header_->map_off_)) { 12768d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Map not at header-defined offset: %x, expected %x", 12778d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers section_offset, header_->map_off_); 127810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 127910037c866b04550fc5461058c398c2e3e509381ajeffhao } 128010037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(uint32_t) + (map->size_ * sizeof(DexFile::MapItem)); 128110037c866b04550fc5461058c398c2e3e509381ajeffhao offset = section_offset + sizeof(uint32_t) + (map->size_ * sizeof(DexFile::MapItem)); 128210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 128310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: 128410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: 128510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: 128610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 128710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: 128810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: 128910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: 129010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: 129110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: 129210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: 129310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraDataSection(section_offset, section_count, type)) { 129410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 129510037c866b04550fc5461058c398c2e3e509381ajeffhao } 12968a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers offset = ptr_ - begin_; 129710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 129810037c866b04550fc5461058c398c2e3e509381ajeffhao default: 12998d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 130010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 130110037c866b04550fc5461058c398c2e3e509381ajeffhao } 130210037c866b04550fc5461058c398c2e3e509381ajeffhao 130310037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 130410037c866b04550fc5461058c398c2e3e509381ajeffhao } 130510037c866b04550fc5461058c398c2e3e509381ajeffhao 130610037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 130710037c866b04550fc5461058c398c2e3e509381ajeffhao} 130810037c866b04550fc5461058c398c2e3e509381ajeffhao 13098a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckOffsetToTypeMap(size_t offset, uint16_t type) { 131002e25119b15a6f619f17db99f5d05124a5807ff3Mathieu Chartier auto it = offset_to_type_map_.find(offset); 13118d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(it == offset_to_type_map_.end())) { 13128a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("No data map entry found @ %zx; expected %x", offset, type); 131310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 131410037c866b04550fc5461058c398c2e3e509381ajeffhao } 13158d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(it->second != type)) { 13168a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers ErrorStringPrintf("Unexpected data map entry @ %zx; expected %x, found %x", 13178d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers offset, type, it->second); 131810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 131910037c866b04550fc5461058c398c2e3e509381ajeffhao } 132010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 132110037c866b04550fc5461058c398c2e3e509381ajeffhao} 132210037c866b04550fc5461058c398c2e3e509381ajeffhao 132310037c866b04550fc5461058c398c2e3e509381ajeffhaouint16_t DexFileVerifier::FindFirstClassDataDefiner(const byte* ptr) const { 132410037c866b04550fc5461058c398c2e3e509381ajeffhao ClassDataItemIterator it(*dex_file_, ptr); 132510037c866b04550fc5461058c398c2e3e509381ajeffhao 132610037c866b04550fc5461058c398c2e3e509381ajeffhao if (it.HasNextStaticField() || it.HasNextInstanceField()) { 132710037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldId& field = dex_file_->GetFieldId(it.GetMemberIndex()); 132810037c866b04550fc5461058c398c2e3e509381ajeffhao return field.class_idx_; 132910037c866b04550fc5461058c398c2e3e509381ajeffhao } 133010037c866b04550fc5461058c398c2e3e509381ajeffhao 133110037c866b04550fc5461058c398c2e3e509381ajeffhao if (it.HasNextDirectMethod() || it.HasNextVirtualMethod()) { 133210037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodId& method = dex_file_->GetMethodId(it.GetMemberIndex()); 133310037c866b04550fc5461058c398c2e3e509381ajeffhao return method.class_idx_; 133410037c866b04550fc5461058c398c2e3e509381ajeffhao } 133510037c866b04550fc5461058c398c2e3e509381ajeffhao 133610037c866b04550fc5461058c398c2e3e509381ajeffhao return DexFile::kDexNoIndex16; 133710037c866b04550fc5461058c398c2e3e509381ajeffhao} 133810037c866b04550fc5461058c398c2e3e509381ajeffhao 133910037c866b04550fc5461058c398c2e3e509381ajeffhaouint16_t DexFileVerifier::FindFirstAnnotationsDirectoryDefiner(const byte* ptr) const { 134010037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationsDirectoryItem* item = 134110037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationsDirectoryItem*>(ptr); 134210037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->fields_size_ != 0) { 134310037c866b04550fc5461058c398c2e3e509381ajeffhao DexFile::FieldAnnotationsItem* field_items = (DexFile::FieldAnnotationsItem*) (item + 1); 134410037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldId& field = dex_file_->GetFieldId(field_items[0].field_idx_); 134510037c866b04550fc5461058c398c2e3e509381ajeffhao return field.class_idx_; 134610037c866b04550fc5461058c398c2e3e509381ajeffhao } 134710037c866b04550fc5461058c398c2e3e509381ajeffhao 134810037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->methods_size_ != 0) { 134910037c866b04550fc5461058c398c2e3e509381ajeffhao DexFile::MethodAnnotationsItem* method_items = (DexFile::MethodAnnotationsItem*) (item + 1); 135010037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodId& method = dex_file_->GetMethodId(method_items[0].method_idx_); 135110037c866b04550fc5461058c398c2e3e509381ajeffhao return method.class_idx_; 135210037c866b04550fc5461058c398c2e3e509381ajeffhao } 135310037c866b04550fc5461058c398c2e3e509381ajeffhao 135410037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->parameters_size_ != 0) { 135510037c866b04550fc5461058c398c2e3e509381ajeffhao DexFile::ParameterAnnotationsItem* parameter_items = (DexFile::ParameterAnnotationsItem*) (item + 1); 135610037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodId& method = dex_file_->GetMethodId(parameter_items[0].method_idx_); 135710037c866b04550fc5461058c398c2e3e509381ajeffhao return method.class_idx_; 135810037c866b04550fc5461058c398c2e3e509381ajeffhao } 135910037c866b04550fc5461058c398c2e3e509381ajeffhao 136010037c866b04550fc5461058c398c2e3e509381ajeffhao return DexFile::kDexNoIndex16; 136110037c866b04550fc5461058c398c2e3e509381ajeffhao} 136210037c866b04550fc5461058c398c2e3e509381ajeffhao 136310037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterStringIdItem() { 136410037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::StringId* item = reinterpret_cast<const DexFile::StringId*>(ptr_); 136510037c866b04550fc5461058c398c2e3e509381ajeffhao 136610037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the map to make sure it has the right offset->type. 136710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckOffsetToTypeMap(item->string_data_off_, DexFile::kDexTypeStringDataItem)) { 136810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 136910037c866b04550fc5461058c398c2e3e509381ajeffhao } 137010037c866b04550fc5461058c398c2e3e509381ajeffhao 137110037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. 137210037c866b04550fc5461058c398c2e3e509381ajeffhao if (previous_item_ != NULL) { 137310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::StringId* prev_item = reinterpret_cast<const DexFile::StringId*>(previous_item_); 137410037c866b04550fc5461058c398c2e3e509381ajeffhao const char* prev_str = dex_file_->GetStringData(*prev_item); 137510037c866b04550fc5461058c398c2e3e509381ajeffhao const char* str = dex_file_->GetStringData(*item); 13768d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(CompareModifiedUtf8ToModifiedUtf8AsUtf16CodePointValues(prev_str, str) >= 0)) { 13778d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order string_ids: '%s' then '%s'", prev_str, str); 137810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 137910037c866b04550fc5461058c398c2e3e509381ajeffhao } 138010037c866b04550fc5461058c398c2e3e509381ajeffhao } 138110037c866b04550fc5461058c398c2e3e509381ajeffhao 138210037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::StringId); 138310037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 138410037c866b04550fc5461058c398c2e3e509381ajeffhao} 138510037c866b04550fc5461058c398c2e3e509381ajeffhao 138610037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterTypeIdItem() { 138710037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TypeId* item = reinterpret_cast<const DexFile::TypeId*>(ptr_); 138810037c866b04550fc5461058c398c2e3e509381ajeffhao const char* descriptor = dex_file_->StringDataByIdx(item->descriptor_idx_); 138910037c866b04550fc5461058c398c2e3e509381ajeffhao 139010037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the descriptor is a valid type. 13918d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidDescriptor(descriptor))) { 13928d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid type descriptor: '%s'", descriptor); 139310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 139410037c866b04550fc5461058c398c2e3e509381ajeffhao } 139510037c866b04550fc5461058c398c2e3e509381ajeffhao 139610037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. 139710037c866b04550fc5461058c398c2e3e509381ajeffhao if (previous_item_ != NULL) { 139810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TypeId* prev_item = reinterpret_cast<const DexFile::TypeId*>(previous_item_); 13998d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->descriptor_idx_ >= item->descriptor_idx_)) { 14008d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order type_ids: %x then %x", 14018d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers prev_item->descriptor_idx_, item->descriptor_idx_); 140210037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 140310037c866b04550fc5461058c398c2e3e509381ajeffhao } 140410037c866b04550fc5461058c398c2e3e509381ajeffhao } 140510037c866b04550fc5461058c398c2e3e509381ajeffhao 140610037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::TypeId); 140710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 140810037c866b04550fc5461058c398c2e3e509381ajeffhao} 140910037c866b04550fc5461058c398c2e3e509381ajeffhao 141010037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterProtoIdItem() { 141110037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ProtoId* item = reinterpret_cast<const DexFile::ProtoId*>(ptr_); 141210037c866b04550fc5461058c398c2e3e509381ajeffhao const char* shorty = dex_file_->StringDataByIdx(item->shorty_idx_); 141310037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->parameters_off_ != 0 && 141410037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->parameters_off_, DexFile::kDexTypeTypeList)) { 141510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 141610037c866b04550fc5461058c398c2e3e509381ajeffhao } 141710037c866b04550fc5461058c398c2e3e509381ajeffhao 141810037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the return type and advance the shorty. 141910037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckShortyDescriptorMatch(*shorty, dex_file_->StringByTypeIdx(item->return_type_idx_), true)) { 142010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 142110037c866b04550fc5461058c398c2e3e509381ajeffhao } 142210037c866b04550fc5461058c398c2e3e509381ajeffhao shorty++; 142310037c866b04550fc5461058c398c2e3e509381ajeffhao 142410037c866b04550fc5461058c398c2e3e509381ajeffhao DexFileParameterIterator it(*dex_file_, *item); 142510037c866b04550fc5461058c398c2e3e509381ajeffhao while (it.HasNext() && *shorty != '\0') { 142610037c866b04550fc5461058c398c2e3e509381ajeffhao const char* descriptor = it.GetDescriptor(); 142710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckShortyDescriptorMatch(*shorty, descriptor, false)) { 142810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 142910037c866b04550fc5461058c398c2e3e509381ajeffhao } 143010037c866b04550fc5461058c398c2e3e509381ajeffhao it.Next(); 143110037c866b04550fc5461058c398c2e3e509381ajeffhao shorty++; 143210037c866b04550fc5461058c398c2e3e509381ajeffhao } 14338d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(it.HasNext() || *shorty != '\0')) { 14348d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched length for parameters and shorty"); 143510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 143610037c866b04550fc5461058c398c2e3e509381ajeffhao } 143710037c866b04550fc5461058c398c2e3e509381ajeffhao 143810037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. This relies on type_ids being in order. 143910037c866b04550fc5461058c398c2e3e509381ajeffhao if (previous_item_ != NULL) { 144010037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ProtoId* prev = reinterpret_cast<const DexFile::ProtoId*>(previous_item_); 14418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev->return_type_idx_ > item->return_type_idx_)) { 14428d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order proto_id return types"); 144310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 144410037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev->return_type_idx_ == item->return_type_idx_) { 144510037c866b04550fc5461058c398c2e3e509381ajeffhao DexFileParameterIterator curr_it(*dex_file_, *item); 144610037c866b04550fc5461058c398c2e3e509381ajeffhao DexFileParameterIterator prev_it(*dex_file_, *prev); 144710037c866b04550fc5461058c398c2e3e509381ajeffhao 144810037c866b04550fc5461058c398c2e3e509381ajeffhao while (curr_it.HasNext() && prev_it.HasNext()) { 144910037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t prev_idx = prev_it.GetTypeIdx(); 145010037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t curr_idx = curr_it.GetTypeIdx(); 145110037c866b04550fc5461058c398c2e3e509381ajeffhao if (prev_idx == DexFile::kDexNoIndex16) { 145210037c866b04550fc5461058c398c2e3e509381ajeffhao break; 145310037c866b04550fc5461058c398c2e3e509381ajeffhao } 14548d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(curr_idx == DexFile::kDexNoIndex16)) { 14558d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order proto_id arguments"); 145610037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 145710037c866b04550fc5461058c398c2e3e509381ajeffhao } 145810037c866b04550fc5461058c398c2e3e509381ajeffhao 145910037c866b04550fc5461058c398c2e3e509381ajeffhao if (prev_idx < curr_idx) { 146010037c866b04550fc5461058c398c2e3e509381ajeffhao break; 14618d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers } else if (UNLIKELY(prev_idx > curr_idx)) { 14628d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order proto_id arguments"); 146310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 146410037c866b04550fc5461058c398c2e3e509381ajeffhao } 146510037c866b04550fc5461058c398c2e3e509381ajeffhao 146610037c866b04550fc5461058c398c2e3e509381ajeffhao prev_it.Next(); 146710037c866b04550fc5461058c398c2e3e509381ajeffhao curr_it.Next(); 146810037c866b04550fc5461058c398c2e3e509381ajeffhao } 146910037c866b04550fc5461058c398c2e3e509381ajeffhao } 147010037c866b04550fc5461058c398c2e3e509381ajeffhao } 147110037c866b04550fc5461058c398c2e3e509381ajeffhao 147210037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ProtoId); 147310037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 147410037c866b04550fc5461058c398c2e3e509381ajeffhao} 147510037c866b04550fc5461058c398c2e3e509381ajeffhao 147610037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterFieldIdItem() { 147710037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldId* item = reinterpret_cast<const DexFile::FieldId*>(ptr_); 147810037c866b04550fc5461058c398c2e3e509381ajeffhao 147910037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the class descriptor is valid. 148010037c866b04550fc5461058c398c2e3e509381ajeffhao const char* descriptor = dex_file_->StringByTypeIdx(item->class_idx_); 14818d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidDescriptor(descriptor) || descriptor[0] != 'L')) { 14828d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid descriptor for class_idx: '%s'", descriptor); 148310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 148410037c866b04550fc5461058c398c2e3e509381ajeffhao } 148510037c866b04550fc5461058c398c2e3e509381ajeffhao 148610037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the type descriptor is a valid field name. 148710037c866b04550fc5461058c398c2e3e509381ajeffhao descriptor = dex_file_->StringByTypeIdx(item->type_idx_); 14888d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidDescriptor(descriptor) || descriptor[0] == 'V')) { 14898d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid descriptor for type_idx: '%s'", descriptor); 149010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 149110037c866b04550fc5461058c398c2e3e509381ajeffhao } 149210037c866b04550fc5461058c398c2e3e509381ajeffhao 149310037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the name is valid. 149410037c866b04550fc5461058c398c2e3e509381ajeffhao descriptor = dex_file_->StringDataByIdx(item->name_idx_); 14958d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidMemberName(descriptor))) { 14968d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid field name: '%s'", descriptor); 149710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 149810037c866b04550fc5461058c398c2e3e509381ajeffhao } 149910037c866b04550fc5461058c398c2e3e509381ajeffhao 150010037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. This relies on the other sections being in order. 150110037c866b04550fc5461058c398c2e3e509381ajeffhao if (previous_item_ != NULL) { 150210037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldId* prev_item = reinterpret_cast<const DexFile::FieldId*>(previous_item_); 15038d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->class_idx_ > item->class_idx_)) { 15048d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_ids"); 150510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 150610037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->class_idx_ == item->class_idx_) { 15078d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->name_idx_ > item->name_idx_)) { 15088d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_ids"); 150910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 151010037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->name_idx_ == item->name_idx_) { 15118d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->type_idx_ >= item->type_idx_)) { 15128d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order field_ids"); 151310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 151410037c866b04550fc5461058c398c2e3e509381ajeffhao } 151510037c866b04550fc5461058c398c2e3e509381ajeffhao } 151610037c866b04550fc5461058c398c2e3e509381ajeffhao } 151710037c866b04550fc5461058c398c2e3e509381ajeffhao } 151810037c866b04550fc5461058c398c2e3e509381ajeffhao 151910037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::FieldId); 152010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 152110037c866b04550fc5461058c398c2e3e509381ajeffhao} 152210037c866b04550fc5461058c398c2e3e509381ajeffhao 152310037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterMethodIdItem() { 152410037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodId* item = reinterpret_cast<const DexFile::MethodId*>(ptr_); 152510037c866b04550fc5461058c398c2e3e509381ajeffhao 152610037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the class descriptor is a valid reference name. 152710037c866b04550fc5461058c398c2e3e509381ajeffhao const char* descriptor = dex_file_->StringByTypeIdx(item->class_idx_); 15288d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidDescriptor(descriptor) || (descriptor[0] != 'L' && descriptor[0] != '['))) { 15298d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid descriptor for class_idx: '%s'", descriptor); 153010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 153110037c866b04550fc5461058c398c2e3e509381ajeffhao } 153210037c866b04550fc5461058c398c2e3e509381ajeffhao 153310037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that the name is valid. 153410037c866b04550fc5461058c398c2e3e509381ajeffhao descriptor = dex_file_->StringDataByIdx(item->name_idx_); 15358d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidMemberName(descriptor))) { 15368d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid method name: '%s'", descriptor); 153710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 153810037c866b04550fc5461058c398c2e3e509381ajeffhao } 153910037c866b04550fc5461058c398c2e3e509381ajeffhao 154010037c866b04550fc5461058c398c2e3e509381ajeffhao // Check ordering between items. This relies on the other sections being in order. 154110037c866b04550fc5461058c398c2e3e509381ajeffhao if (previous_item_ != NULL) { 154210037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodId* prev_item = reinterpret_cast<const DexFile::MethodId*>(previous_item_); 15438d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->class_idx_ > item->class_idx_)) { 15448d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_ids"); 154510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 154610037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->class_idx_ == item->class_idx_) { 15478d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->name_idx_ > item->name_idx_)) { 15488d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_ids"); 154910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 155010037c866b04550fc5461058c398c2e3e509381ajeffhao } else if (prev_item->name_idx_ == item->name_idx_) { 15518d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(prev_item->proto_idx_ >= item->proto_idx_)) { 15528d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order method_ids"); 155310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 155410037c866b04550fc5461058c398c2e3e509381ajeffhao } 155510037c866b04550fc5461058c398c2e3e509381ajeffhao } 155610037c866b04550fc5461058c398c2e3e509381ajeffhao } 155710037c866b04550fc5461058c398c2e3e509381ajeffhao } 155810037c866b04550fc5461058c398c2e3e509381ajeffhao 155910037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::MethodId); 156010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 156110037c866b04550fc5461058c398c2e3e509381ajeffhao} 156210037c866b04550fc5461058c398c2e3e509381ajeffhao 156310037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterClassDefItem() { 156410037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ClassDef* item = reinterpret_cast<const DexFile::ClassDef*>(ptr_); 156510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t class_idx = item->class_idx_; 156610037c866b04550fc5461058c398c2e3e509381ajeffhao const char* descriptor = dex_file_->StringByTypeIdx(class_idx); 156710037c866b04550fc5461058c398c2e3e509381ajeffhao 15688d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidDescriptor(descriptor) || descriptor[0] != 'L')) { 15698d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid class descriptor: '%s'", descriptor); 157010037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 157110037c866b04550fc5461058c398c2e3e509381ajeffhao } 157210037c866b04550fc5461058c398c2e3e509381ajeffhao 157310037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->interfaces_off_ != 0 && 157410037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->interfaces_off_, DexFile::kDexTypeTypeList)) { 157510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 157610037c866b04550fc5461058c398c2e3e509381ajeffhao } 157710037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->annotations_off_ != 0 && 157810037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->annotations_off_, DexFile::kDexTypeAnnotationsDirectoryItem)) { 157910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 158010037c866b04550fc5461058c398c2e3e509381ajeffhao } 158110037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->class_data_off_ != 0 && 158210037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->class_data_off_, DexFile::kDexTypeClassDataItem)) { 158310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 158410037c866b04550fc5461058c398c2e3e509381ajeffhao } 158510037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->static_values_off_ != 0 && 158610037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->static_values_off_, DexFile::kDexTypeEncodedArrayItem)) { 158710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 158810037c866b04550fc5461058c398c2e3e509381ajeffhao } 158910037c866b04550fc5461058c398c2e3e509381ajeffhao 159010037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->superclass_idx_ != DexFile::kDexNoIndex16) { 159110037c866b04550fc5461058c398c2e3e509381ajeffhao descriptor = dex_file_->StringByTypeIdx(item->superclass_idx_); 15928d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidDescriptor(descriptor) || descriptor[0] != 'L')) { 15938d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid superclass: '%s'", descriptor); 159410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 159510037c866b04550fc5461058c398c2e3e509381ajeffhao } 159610037c866b04550fc5461058c398c2e3e509381ajeffhao } 159710037c866b04550fc5461058c398c2e3e509381ajeffhao 159810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::TypeList* interfaces = dex_file_->GetInterfacesList(*item); 159910037c866b04550fc5461058c398c2e3e509381ajeffhao if (interfaces != NULL) { 160010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t size = interfaces->Size(); 160110037c866b04550fc5461058c398c2e3e509381ajeffhao 160210037c866b04550fc5461058c398c2e3e509381ajeffhao // Ensure that all interfaces refer to classes (not arrays or primitives). 160310037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < size; i++) { 160410037c866b04550fc5461058c398c2e3e509381ajeffhao descriptor = dex_file_->StringByTypeIdx(interfaces->GetTypeItem(i).type_idx_); 16058d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(!IsValidDescriptor(descriptor) || descriptor[0] != 'L')) { 16068d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid interface: '%s'", descriptor); 160710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 160810037c866b04550fc5461058c398c2e3e509381ajeffhao } 160910037c866b04550fc5461058c398c2e3e509381ajeffhao } 161010037c866b04550fc5461058c398c2e3e509381ajeffhao 161110037c866b04550fc5461058c398c2e3e509381ajeffhao /* 161210037c866b04550fc5461058c398c2e3e509381ajeffhao * Ensure that there are no duplicates. This is an O(N^2) test, but in 161310037c866b04550fc5461058c398c2e3e509381ajeffhao * practice the number of interfaces implemented by any given class is low. 161410037c866b04550fc5461058c398c2e3e509381ajeffhao */ 161510037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 1; i < size; i++) { 161610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx1 = interfaces->GetTypeItem(i).type_idx_; 161710037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t j =0; j < i; j++) { 161810037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx2 = interfaces->GetTypeItem(j).type_idx_; 16198d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(idx1 == idx2)) { 16208d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Duplicate interface: '%s'", dex_file_->StringByTypeIdx(idx1)); 162110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 162210037c866b04550fc5461058c398c2e3e509381ajeffhao } 162310037c866b04550fc5461058c398c2e3e509381ajeffhao } 162410037c866b04550fc5461058c398c2e3e509381ajeffhao } 162510037c866b04550fc5461058c398c2e3e509381ajeffhao } 162610037c866b04550fc5461058c398c2e3e509381ajeffhao 162710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that references in class_data_item are to the right class. 162810037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->class_data_off_ != 0) { 162930fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers const byte* data = begin_ + item->class_data_off_; 163010037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t data_definer = FindFirstClassDataDefiner(data); 16318d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((data_definer != item->class_idx_) && (data_definer != DexFile::kDexNoIndex16))) { 16328d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid class_data_item"); 163310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 163410037c866b04550fc5461058c398c2e3e509381ajeffhao } 163510037c866b04550fc5461058c398c2e3e509381ajeffhao } 163610037c866b04550fc5461058c398c2e3e509381ajeffhao 163710037c866b04550fc5461058c398c2e3e509381ajeffhao // Check that references in annotations_directory_item are to right class. 163810037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->annotations_off_ != 0) { 163930fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers const byte* data = begin_ + item->annotations_off_; 164010037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t annotations_definer = FindFirstAnnotationsDirectoryDefiner(data); 16418d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY((annotations_definer != item->class_idx_) && 16428d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers (annotations_definer != DexFile::kDexNoIndex16))) { 16438d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Invalid annotations_directory_item"); 164410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 164510037c866b04550fc5461058c398c2e3e509381ajeffhao } 164610037c866b04550fc5461058c398c2e3e509381ajeffhao } 164710037c866b04550fc5461058c398c2e3e509381ajeffhao 164810037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ += sizeof(DexFile::ClassDef); 164910037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 165010037c866b04550fc5461058c398c2e3e509381ajeffhao} 165110037c866b04550fc5461058c398c2e3e509381ajeffhao 165210037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterAnnotationSetRefList() { 165310037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationSetRefList* list = 165410037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationSetRefList*>(ptr_); 165510037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationSetRefItem* item = list->list_; 165610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = list->size_; 165710037c866b04550fc5461058c398c2e3e509381ajeffhao 165810037c866b04550fc5461058c398c2e3e509381ajeffhao while (count--) { 165910037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->annotations_off_ != 0 && 166010037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 166110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 166210037c866b04550fc5461058c398c2e3e509381ajeffhao } 166310037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 166410037c866b04550fc5461058c398c2e3e509381ajeffhao } 166510037c866b04550fc5461058c398c2e3e509381ajeffhao 166610037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = reinterpret_cast<const byte*>(item); 166710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 166810037c866b04550fc5461058c398c2e3e509381ajeffhao} 166910037c866b04550fc5461058c398c2e3e509381ajeffhao 167010037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterAnnotationSetItem() { 167110037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationSetItem* set = reinterpret_cast<const DexFile::AnnotationSetItem*>(ptr_); 167210037c866b04550fc5461058c398c2e3e509381ajeffhao const uint32_t* offsets = set->entries_; 167310037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = set->size_; 167410037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t last_idx = 0; 167510037c866b04550fc5461058c398c2e3e509381ajeffhao 167610037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < count; i++) { 167710037c866b04550fc5461058c398c2e3e509381ajeffhao if (*offsets != 0 && !CheckOffsetToTypeMap(*offsets, DexFile::kDexTypeAnnotationItem)) { 167810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 167910037c866b04550fc5461058c398c2e3e509381ajeffhao } 168010037c866b04550fc5461058c398c2e3e509381ajeffhao 168110037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the annotation from the offset and the type index for the annotation. 168210037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationItem* annotation = 168330fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers reinterpret_cast<const DexFile::AnnotationItem*>(begin_ + *offsets); 168410037c866b04550fc5461058c398c2e3e509381ajeffhao const uint8_t* data = annotation->annotation_; 168510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t idx = DecodeUnsignedLeb128(&data); 168610037c866b04550fc5461058c398c2e3e509381ajeffhao 16878d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(last_idx >= idx && i != 0)) { 16888d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Out-of-order entry types: %x then %x", last_idx, idx); 168910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 169010037c866b04550fc5461058c398c2e3e509381ajeffhao } 169110037c866b04550fc5461058c398c2e3e509381ajeffhao 169210037c866b04550fc5461058c398c2e3e509381ajeffhao last_idx = idx; 169310037c866b04550fc5461058c398c2e3e509381ajeffhao offsets++; 169410037c866b04550fc5461058c398c2e3e509381ajeffhao } 169510037c866b04550fc5461058c398c2e3e509381ajeffhao 169610037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = reinterpret_cast<const byte*>(offsets); 169710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 169810037c866b04550fc5461058c398c2e3e509381ajeffhao} 169910037c866b04550fc5461058c398c2e3e509381ajeffhao 170010037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterClassDataItem() { 170110037c866b04550fc5461058c398c2e3e509381ajeffhao ClassDataItemIterator it(*dex_file_, ptr_); 170210037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t defining_class = FindFirstClassDataDefiner(ptr_); 170310037c866b04550fc5461058c398c2e3e509381ajeffhao 170410037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextStaticField() || it.HasNextInstanceField(); it.Next()) { 170510037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldId& field = dex_file_->GetFieldId(it.GetMemberIndex()); 17068d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(field.class_idx_ != defining_class)) { 17078d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for class_data_item field"); 170810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 170910037c866b04550fc5461058c398c2e3e509381ajeffhao } 171010037c866b04550fc5461058c398c2e3e509381ajeffhao } 171110037c866b04550fc5461058c398c2e3e509381ajeffhao for (; it.HasNextDirectMethod() || it.HasNextVirtualMethod(); it.Next()) { 171210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t code_off = it.GetMethodCodeItemOffset(); 171310037c866b04550fc5461058c398c2e3e509381ajeffhao if (code_off != 0 && !CheckOffsetToTypeMap(code_off, DexFile::kDexTypeCodeItem)) { 171410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 171510037c866b04550fc5461058c398c2e3e509381ajeffhao } 171610037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodId& method = dex_file_->GetMethodId(it.GetMemberIndex()); 17178d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(method.class_idx_ != defining_class)) { 17188d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for class_data_item method"); 171910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 172010037c866b04550fc5461058c398c2e3e509381ajeffhao } 172110037c866b04550fc5461058c398c2e3e509381ajeffhao } 172210037c866b04550fc5461058c398c2e3e509381ajeffhao 172310037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = it.EndDataPointer(); 172410037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 172510037c866b04550fc5461058c398c2e3e509381ajeffhao} 172610037c866b04550fc5461058c398c2e3e509381ajeffhao 172710037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterAnnotationsDirectoryItem() { 172810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::AnnotationsDirectoryItem* item = 172910037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::AnnotationsDirectoryItem*>(ptr_); 173010037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t defining_class = FindFirstAnnotationsDirectoryDefiner(ptr_); 173110037c866b04550fc5461058c398c2e3e509381ajeffhao 173210037c866b04550fc5461058c398c2e3e509381ajeffhao if (item->class_annotations_off_ != 0 && 173310037c866b04550fc5461058c398c2e3e509381ajeffhao !CheckOffsetToTypeMap(item->class_annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 173410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 173510037c866b04550fc5461058c398c2e3e509381ajeffhao } 173610037c866b04550fc5461058c398c2e3e509381ajeffhao 173710037c866b04550fc5461058c398c2e3e509381ajeffhao // Field annotations follow immediately after the annotations directory. 173810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldAnnotationsItem* field_item = 173910037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::FieldAnnotationsItem*>(item + 1); 174010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t field_count = item->fields_size_; 174110037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < field_count; i++) { 174210037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::FieldId& field = dex_file_->GetFieldId(field_item->field_idx_); 17438d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(field.class_idx_ != defining_class)) { 17448d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for field_annotation"); 174510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 174610037c866b04550fc5461058c398c2e3e509381ajeffhao } 174710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckOffsetToTypeMap(field_item->annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 174810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 174910037c866b04550fc5461058c398c2e3e509381ajeffhao } 175010037c866b04550fc5461058c398c2e3e509381ajeffhao field_item++; 175110037c866b04550fc5461058c398c2e3e509381ajeffhao } 175210037c866b04550fc5461058c398c2e3e509381ajeffhao 175310037c866b04550fc5461058c398c2e3e509381ajeffhao // Method annotations follow immediately after field annotations. 175410037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodAnnotationsItem* method_item = 175510037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::MethodAnnotationsItem*>(field_item); 175610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t method_count = item->methods_size_; 175710037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < method_count; i++) { 175810037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodId& method = dex_file_->GetMethodId(method_item->method_idx_); 17598d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(method.class_idx_ != defining_class)) { 17608d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for method_annotation"); 176110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 176210037c866b04550fc5461058c398c2e3e509381ajeffhao } 176310037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckOffsetToTypeMap(method_item->annotations_off_, DexFile::kDexTypeAnnotationSetItem)) { 176410037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 176510037c866b04550fc5461058c398c2e3e509381ajeffhao } 176610037c866b04550fc5461058c398c2e3e509381ajeffhao method_item++; 176710037c866b04550fc5461058c398c2e3e509381ajeffhao } 176810037c866b04550fc5461058c398c2e3e509381ajeffhao 176910037c866b04550fc5461058c398c2e3e509381ajeffhao // Parameter annotations follow immediately after method annotations. 177010037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::ParameterAnnotationsItem* parameter_item = 177110037c866b04550fc5461058c398c2e3e509381ajeffhao reinterpret_cast<const DexFile::ParameterAnnotationsItem*>(method_item); 177210037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t parameter_count = item->parameters_size_; 177310037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < parameter_count; i++) { 177410037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MethodId& parameter_method = dex_file_->GetMethodId(parameter_item->method_idx_); 17758d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers if (UNLIKELY(parameter_method.class_idx_ != defining_class)) { 17768d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Mismatched defining class for parameter_annotation"); 177710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 177810037c866b04550fc5461058c398c2e3e509381ajeffhao } 17792b87ddf36abff711fa2233c49bffc7ceb03b15d7Dragos Sbirlea if (!CheckOffsetToTypeMap(parameter_item->annotations_off_, 17802b87ddf36abff711fa2233c49bffc7ceb03b15d7Dragos Sbirlea DexFile::kDexTypeAnnotationSetRefList)) { 178110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 178210037c866b04550fc5461058c398c2e3e509381ajeffhao } 178310037c866b04550fc5461058c398c2e3e509381ajeffhao parameter_item++; 178410037c866b04550fc5461058c398c2e3e509381ajeffhao } 178510037c866b04550fc5461058c398c2e3e509381ajeffhao 178610037c866b04550fc5461058c398c2e3e509381ajeffhao ptr_ = reinterpret_cast<const byte*>(parameter_item); 178710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 178810037c866b04550fc5461058c398c2e3e509381ajeffhao} 178910037c866b04550fc5461058c398c2e3e509381ajeffhao 17908a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogersbool DexFileVerifier::CheckInterSectionIterate(size_t offset, uint32_t count, uint16_t type) { 179110037c866b04550fc5461058c398c2e3e509381ajeffhao // Get the right alignment mask for the type of section. 17928a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers size_t alignment_mask; 179310037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 179410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 179510037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint8_t) - 1; 179610037c866b04550fc5461058c398c2e3e509381ajeffhao break; 179710037c866b04550fc5461058c398c2e3e509381ajeffhao default: 179810037c866b04550fc5461058c398c2e3e509381ajeffhao alignment_mask = sizeof(uint32_t) - 1; 179910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 180010037c866b04550fc5461058c398c2e3e509381ajeffhao } 180110037c866b04550fc5461058c398c2e3e509381ajeffhao 180210037c866b04550fc5461058c398c2e3e509381ajeffhao // Iterate through the items in the section. 180310037c866b04550fc5461058c398c2e3e509381ajeffhao previous_item_ = NULL; 180410037c866b04550fc5461058c398c2e3e509381ajeffhao for (uint32_t i = 0; i < count; i++) { 180510037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t new_offset = (offset + alignment_mask) & ~alignment_mask; 180630fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers ptr_ = begin_ + new_offset; 180710037c866b04550fc5461058c398c2e3e509381ajeffhao const byte* prev_ptr = ptr_; 180810037c866b04550fc5461058c398c2e3e509381ajeffhao 180910037c866b04550fc5461058c398c2e3e509381ajeffhao // Check depending on the section type. 181010037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 181110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: { 181210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterStringIdItem()) { 181310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 181410037c866b04550fc5461058c398c2e3e509381ajeffhao } 181510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 181610037c866b04550fc5461058c398c2e3e509381ajeffhao } 181710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: { 181810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterTypeIdItem()) { 181910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 182010037c866b04550fc5461058c398c2e3e509381ajeffhao } 182110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 182210037c866b04550fc5461058c398c2e3e509381ajeffhao } 182310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: { 182410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterProtoIdItem()) { 182510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 182610037c866b04550fc5461058c398c2e3e509381ajeffhao } 182710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 182810037c866b04550fc5461058c398c2e3e509381ajeffhao } 182910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: { 183010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterFieldIdItem()) { 183110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 183210037c866b04550fc5461058c398c2e3e509381ajeffhao } 183310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 183410037c866b04550fc5461058c398c2e3e509381ajeffhao } 183510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: { 183610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterMethodIdItem()) { 183710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 183810037c866b04550fc5461058c398c2e3e509381ajeffhao } 183910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 184010037c866b04550fc5461058c398c2e3e509381ajeffhao } 184110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: { 184210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterClassDefItem()) { 184310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 184410037c866b04550fc5461058c398c2e3e509381ajeffhao } 184510037c866b04550fc5461058c398c2e3e509381ajeffhao break; 184610037c866b04550fc5461058c398c2e3e509381ajeffhao } 184710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: { 184810037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterAnnotationSetRefList()) { 184910037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 185010037c866b04550fc5461058c398c2e3e509381ajeffhao } 185110037c866b04550fc5461058c398c2e3e509381ajeffhao break; 185210037c866b04550fc5461058c398c2e3e509381ajeffhao } 185310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: { 185410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterAnnotationSetItem()) { 185510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 185610037c866b04550fc5461058c398c2e3e509381ajeffhao } 185710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 185810037c866b04550fc5461058c398c2e3e509381ajeffhao } 185910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: { 186010037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterClassDataItem()) { 186110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 186210037c866b04550fc5461058c398c2e3e509381ajeffhao } 186310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 186410037c866b04550fc5461058c398c2e3e509381ajeffhao } 186510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: { 186610037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterAnnotationsDirectoryItem()) { 186710037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 186810037c866b04550fc5461058c398c2e3e509381ajeffhao } 186910037c866b04550fc5461058c398c2e3e509381ajeffhao break; 187010037c866b04550fc5461058c398c2e3e509381ajeffhao } 187110037c866b04550fc5461058c398c2e3e509381ajeffhao default: 18728d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 187310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 187410037c866b04550fc5461058c398c2e3e509381ajeffhao } 187510037c866b04550fc5461058c398c2e3e509381ajeffhao 187610037c866b04550fc5461058c398c2e3e509381ajeffhao previous_item_ = prev_ptr; 18778a6bbfc66e3cf01d4aa07ee08b515beee481d553Ian Rogers offset = ptr_ - begin_; 187810037c866b04550fc5461058c398c2e3e509381ajeffhao } 187910037c866b04550fc5461058c398c2e3e509381ajeffhao 188010037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 188110037c866b04550fc5461058c398c2e3e509381ajeffhao} 188210037c866b04550fc5461058c398c2e3e509381ajeffhao 188310037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::CheckInterSection() { 188430fab40ee5a07af6b8c3b6b0e9438071695a57f4Ian Rogers const DexFile::MapList* map = reinterpret_cast<const DexFile::MapList*>(begin_ + header_->map_off_); 188510037c866b04550fc5461058c398c2e3e509381ajeffhao const DexFile::MapItem* item = map->list_; 188610037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t count = map->size_; 188710037c866b04550fc5461058c398c2e3e509381ajeffhao 188810037c866b04550fc5461058c398c2e3e509381ajeffhao // Cross check the items listed in the map. 188910037c866b04550fc5461058c398c2e3e509381ajeffhao while (count--) { 189010037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_offset = item->offset_; 189110037c866b04550fc5461058c398c2e3e509381ajeffhao uint32_t section_count = item->size_; 189210037c866b04550fc5461058c398c2e3e509381ajeffhao uint16_t type = item->type_; 189310037c866b04550fc5461058c398c2e3e509381ajeffhao 189410037c866b04550fc5461058c398c2e3e509381ajeffhao switch (type) { 189510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeHeaderItem: 189610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMapList: 189710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeList: 189810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeCodeItem: 189910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringDataItem: 190010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeDebugInfoItem: 190110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationItem: 190210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeEncodedArrayItem: 190310037c866b04550fc5461058c398c2e3e509381ajeffhao break; 190410037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeStringIdItem: 190510037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeTypeIdItem: 190610037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeProtoIdItem: 190710037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeFieldIdItem: 190810037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeMethodIdItem: 190910037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDefItem: 191010037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetRefList: 191110037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationSetItem: 191210037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeClassDataItem: 191310037c866b04550fc5461058c398c2e3e509381ajeffhao case DexFile::kDexTypeAnnotationsDirectoryItem: { 191410037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterSectionIterate(section_offset, section_count, type)) { 191510037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 191610037c866b04550fc5461058c398c2e3e509381ajeffhao } 191710037c866b04550fc5461058c398c2e3e509381ajeffhao break; 191810037c866b04550fc5461058c398c2e3e509381ajeffhao } 191910037c866b04550fc5461058c398c2e3e509381ajeffhao default: 19208d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers ErrorStringPrintf("Unknown map item type %x", type); 192110037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 192210037c866b04550fc5461058c398c2e3e509381ajeffhao } 192310037c866b04550fc5461058c398c2e3e509381ajeffhao 192410037c866b04550fc5461058c398c2e3e509381ajeffhao item++; 192510037c866b04550fc5461058c398c2e3e509381ajeffhao } 192610037c866b04550fc5461058c398c2e3e509381ajeffhao 192710037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 192810037c866b04550fc5461058c398c2e3e509381ajeffhao} 192910037c866b04550fc5461058c398c2e3e509381ajeffhao 193010037c866b04550fc5461058c398c2e3e509381ajeffhaobool DexFileVerifier::Verify() { 193110037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the header. 193210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckHeader()) { 193310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 193410037c866b04550fc5461058c398c2e3e509381ajeffhao } 193510037c866b04550fc5461058c398c2e3e509381ajeffhao 193610037c866b04550fc5461058c398c2e3e509381ajeffhao // Check the map section. 193710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckMap()) { 193810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 193910037c866b04550fc5461058c398c2e3e509381ajeffhao } 194010037c866b04550fc5461058c398c2e3e509381ajeffhao 194110037c866b04550fc5461058c398c2e3e509381ajeffhao // Check structure within remaining sections. 194210037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckIntraSection()) { 194310037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 194410037c866b04550fc5461058c398c2e3e509381ajeffhao } 194510037c866b04550fc5461058c398c2e3e509381ajeffhao 194610037c866b04550fc5461058c398c2e3e509381ajeffhao // Check references from one section to another. 194710037c866b04550fc5461058c398c2e3e509381ajeffhao if (!CheckInterSection()) { 194810037c866b04550fc5461058c398c2e3e509381ajeffhao return false; 194910037c866b04550fc5461058c398c2e3e509381ajeffhao } 195010037c866b04550fc5461058c398c2e3e509381ajeffhao 195110037c866b04550fc5461058c398c2e3e509381ajeffhao return true; 195210037c866b04550fc5461058c398c2e3e509381ajeffhao} 195310037c866b04550fc5461058c398c2e3e509381ajeffhao 19548d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogersvoid DexFileVerifier::ErrorStringPrintf(const char* fmt, ...) { 19558d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers va_list ap; 19568d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers va_start(ap, fmt); 19578d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers DCHECK(failure_reason_.empty()) << failure_reason_; 19588d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers failure_reason_ = StringPrintf("Failure to verify dex file '%s': ", location_); 19598d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers StringAppendV(&failure_reason_, fmt, ap); 19608d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers va_end(ap); 19618d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers} 19628d31bbd3d6536de12bc20e3d29cfe03fe848f9daIan Rogers 196310037c866b04550fc5461058c398c2e3e509381ajeffhao} // namespace art 1964