Bound IINC increment to signed short#526
Conversation
`IINC.setIncrement` stored the increment without checking its range, but `dump` writes the wide-form increment with `writeShort`. A value outside the signed-short range was accepted and then truncated to a different value on dump. Reject it in `setIncrement`, which the constructor routes through too.
garydgregory
changed the title
|
Hello @rootvector2 |
|
the wide form. plain |
|
That's the byte-form |
|
@rootvector2 ty merged 🚀 |
2 participants
IINC.setIncrementstores the increment without checking its range, butdumpwrites the wide-form increment withwriteShort. The wideiincincrement is a signed short, sonew IINC(0, 40000)(orsetIncrementwith any value outside-32768..32767) is accepted andgetIncrementstill returns40000, yetdumpemits-25536. Found while auditing the operand setters around the earliersetIndexbounds fix; the increment is the one that was left unchecked.Reject an out-of-range increment in
setIncrementwith the sameisValidShortguardBranchInstruction.dumpand the siblingsetIndexalready use. The two-arg constructor routes throughsetIncrement, so checking it there covers every construction path.mvn; that'smvnon the command line by itself.