commit de0b996661351450fa4d918706c5322e001c29c9
author Andreas Gampe <agampe@google.com> Wed Aug 27 14:24:42 2014 -0700
committer Andreas Gampe <agampe@google.com> Tue Sep 02 17:24:48 2014 -0700
tree a74031a9577d63786e22c0965f2446072558eb72
parent 6e3604287f73fbc58d8297c0bca6bfe808524a2b

ART: Fix read-out-of-bounds in the compiler

In case of a wide dalvik register, asking for the constant value
can lead to a read out of bounds.

Bug: 17302671

(cherry picked from commit ade731854d18839823e57fb2d3d67238c5467d15)

Change-Id: Ie1849cd67cc418c97cbd7a8524f027f9b66e4c96

compiler/dex/mir_graph.h

diff --git a/compiler/dex/mir_graph.h b/compiler/dex/mir_graph.h
index ef43ea2..078970d 100644
--- a/compiler/dex/mir_graph.h
+++ b/compiler/dex/mir_graph.h
@@ -760,6 +760,8 @@
 
   int64_t ConstantValueWide(RegLocation loc) const {
     DCHECK(IsConst(loc));
+    DCHECK(!loc.high_word);  // Do not allow asking for the high partner.
+    DCHECK_LT(loc.orig_sreg + 1, GetNumSSARegs());
     return (static_cast<int64_t>(constant_values_[loc.orig_sreg + 1]) << 32) |
         Low32Bits(static_cast<int64_t>(constant_values_[loc.orig_sreg]));
   }