Check ranges.

ikvmnet · Aug 17, 2024 · 08d79c5 · 08d79c5
1 parent 52bb104
commit 08d79c5
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 4 deletions.
diff --git a/src/IKVM.ByteCode/Decoding/LookupSwitchCaseTable.cs b/src/IKVM.ByteCode/Decoding/LookupSwitchCaseTable.cs
@@ -78,6 +78,9 @@ internal static bool TryMeasure(ref SequenceReader<byte> reader, ref int size)
             if (reader.TryReadBigEndian(out int npairs) == false)
                 return false;
 
+            if (npairs < 0 || npairs > 16384)
+                throw new InvalidCodeException("Number of conditions in lookupswitch is out of range.");
+
             var pairsSize = npairs * 8;
             size += pairsSize;
             if (reader.TryAdvance(pairsSize) == false)
@@ -99,6 +102,9 @@ internal static bool TryRead(ref SequenceReader<byte> reader, out LookupSwitchCa
             if (reader.TryReadBigEndian(out int npairs) == false)
                 return false;
 
+            if (npairs < 0 || npairs > 16384)
+                throw new InvalidCodeException("Number of conditions in lookupswitch is out of range.");
+
             var pairsSize = npairs * 8;
             if (reader.TryReadExact(pairsSize, out var items) == false)
                 return false;

diff --git a/src/IKVM.ByteCode/Decoding/TableSwitchInstruction.cs b/src/IKVM.ByteCode/Decoding/TableSwitchInstruction.cs
@@ -56,8 +56,10 @@ internal static bool TryMeasure(ref SequenceReader<byte> reader, int offset, ref
             if (reader.TryReadBigEndian(out int high) == false)
                 return false;
 
-            if (high < low)
-                throw new InvalidCodeException("High cannot be less than low.");
+            if (low > high)
+                throw new InvalidCodeException("Low cannot be greater than high.");
+            if (high > 16384L + low)
+                throw new InvalidCodeException("High exceeds maximum size.");
 
             // size of resulting table
             if (TableSwitchCaseTable.TryMeasure(ref reader, high - low + 1, ref size) == false)
@@ -125,8 +127,10 @@ internal static bool TryRead(ref SequenceReader<byte> reader, int offset, out Ta
             if (reader.TryReadBigEndian(out int high) == false)
                 return false;
 
-            if (high < low)
-                throw new InvalidCodeException("High cannot be less than low.");
+            if (low > high)
+                throw new InvalidCodeException("Low cannot be greater than high.");
+            if (high > 16384L + low)
+                throw new InvalidCodeException("High exceeds maximum size.");
 
             // low value is always 4 bytes
             if (TableSwitchCaseTable.TryRead(ref reader, high - low + 1, out var cases) == false)