Address classfile review findings

Author: dlunch

classfile/src/opcode.rs

@@ -406,8 +406,8 @@ impl Opcode {
             0x69 => success(Opcode::Lmul).parse(data),
             0x75 => success(Opcode::Lneg).parse(data),
             0xab => flat_map((take((4 - (offset + 1) % 4) % 4), be_i32, be_i32), |(_, default, npairs)| {
-                move |x| {
-                    if npairs < 0 {
+                move |x: &'a [u8]| {
+                    if npairs < 0 || npairs as usize > x.len() / 8 {
                         return Err(nom::Err::Error(Error::new(x, ErrorKind::Verify)));
                     }
                     map(count((be_i32, be_i32), npairs as usize), |offsets| Opcode::Lookupswitch(default, offsets)).parse(x)
@@ -469,11 +469,11 @@ impl Opcode {
             0x11 => map(be_i16, Opcode::Sipush).parse(data),
             0x5f => success(Opcode::Swap).parse(data),
             0xaa => flat_map((take((4 - (offset + 1) % 4) % 4), be_i32, be_i32, be_i32), |(_, default, low, high)| {
-                move |x| {
+                move |x: &'a [u8]| {
                     let Some(entry_count) = high.checked_sub(low).and_then(|range| range.checked_add(1)) else {
                         return Err(nom::Err::Error(Error::new(x, ErrorKind::Verify)));
                     };
-                    if entry_count < 0 {
+                    if entry_count <= 0 || entry_count as usize > x.len() / 4 {
                         return Err(nom::Err::Error(Error::new(x, ErrorKind::Verify)));
                     }
                     map(count(be_i32, entry_count as usize), |offsets| {

classfile/tests/test.rs

@@ -1,3 +1,5 @@
+use std::collections::BTreeMap;
+
 use java_constants::ClassAccessFlags;
 
 use classfile::{AttributeInfo, ClassFileError, ClassInfo, ConstantPoolReference, Opcode};
@@ -114,6 +116,16 @@ fn test_switch() {
     }
 }
 
+#[test]
+fn test_switch_rejects_entry_counts_larger_than_remaining_input() {
+    let constant_pool = BTreeMap::new();
+    let lookup_switch = [0xab, 0, 0, 0, 0, 0, 0, 0, 0x7f, 0xff, 0xff, 0xff];
+    assert!(Opcode::parse(&lookup_switch, 0, &constant_pool).is_err());
+
+    let table_switch = [0xaa, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x7f, 0xff, 0xff, 0xff];
+    assert!(Opcode::parse(&table_switch, 0, &constant_pool).is_err());
+}
+
 #[test]
 fn test_invokeinterface() {
     let interface = include_bytes!("../../test_data/Interface.class");

jvm_rust/src/class_definition.rs

@@ -164,15 +164,22 @@ impl ClassDefinitionImpl {
                         }
                         Opcode::Invokeinterface(ConstantPoolReference::InterfaceMethodref(reference), _, _)
                         | Opcode::Invokespecial(ConstantPoolReference::Method(reference))
-                        | Opcode::Invokestatic(ConstantPoolReference::Method(reference))
-                        | Opcode::Invokevirtual(ConstantPoolReference::Method(reference)) => {
+                        | Opcode::Invokestatic(ConstantPoolReference::Method(reference)) => {
                             if reference.class.is_empty()
                                 || reference.class.starts_with('[')
                                 || !matches!(JavaType::try_parse(&reference.descriptor), Some(JavaType::Method(_, _)))
                             {
                                 return Err(ClassFileError::InvalidFormat);
                             }
                         }
+                        Opcode::Invokevirtual(ConstantPoolReference::Method(reference)) => {
+                            if reference.class.is_empty()
+                                || (reference.class.starts_with('[') && !matches!(JavaType::try_parse(&reference.class), Some(JavaType::Array(_))))
+                                || !matches!(JavaType::try_parse(&reference.descriptor), Some(JavaType::Method(_, _)))
+                            {
+                                return Err(ClassFileError::InvalidFormat);
+                            }
+                        }
                         Opcode::Anewarray(ConstantPoolReference::Class(name))
                         | Opcode::Checkcast(ConstantPoolReference::Class(name))
                         | Opcode::Instanceof(ConstantPoolReference::Class(name))

test_data/Array.class

@@ -12,3 +12,5 @@ test한글
 10
 10
 10
+112344
+654321

test_data/Array.txt

@@ -31,5 +31,10 @@ public static void main(String[] args) {
         System.out.println(char_array.length);
         System.out.println(boolean_array.length);
         System.out.println(string_array.length);
+
+        int[] cloned_int_array = (int[]) int_array.clone();
+        cloned_int_array[0] = 654321;
+        System.out.println(int_array[0]);
+        System.out.println(cloned_int_array[0]);
     }
 }