Author: kumpera
Date: 2007-12-31 13:35:12 -0500 (Mon, 31 Dec 2007)
New Revision: 92069
Modified:
trunk/mono/mono/metadata/ChangeLog
trunk/mono/mono/metadata/loader.c
trunk/mono/mono/metadata/metadata.c
Log:
2007-12-31 Rodrigo Kumpera <[EMAIL PROTECTED]>
* metadata.c (mono_metadata_decode_row): Assert if index is bigger
than the table row count. It's the resposibility of the caller to
make the bounds check and raise the correct error.
* metadata.c (mono_metadata_decode_row_col): Same.
* loader.c (mono_get_method_from_token): perform bounds check
on token for methoddef table.
Modified: trunk/mono/mono/metadata/ChangeLog
===================================================================
--- trunk/mono/mono/metadata/ChangeLog 2007-12-31 18:28:15 UTC (rev 92068)
+++ trunk/mono/mono/metadata/ChangeLog 2007-12-31 18:35:12 UTC (rev 92069)
@@ -1,3 +1,14 @@
+2007-12-31 Rodrigo Kumpera <[EMAIL PROTECTED]>
+
+ * metadata.c (mono_metadata_decode_row): Assert if index is bigger
+ than the table row count. It's the resposibility of the caller to
+ make the bounds check and raise the correct error.
+
+ * metadata.c (mono_metadata_decode_row_col): Same.
+
+ * loader.c (mono_get_method_from_token): perform bounds check
+ on token for methoddef table.
+
2007-12-29 Miguel de Icaza <[EMAIL PROTECTED]>
* icall.c
Modified: trunk/mono/mono/metadata/loader.c
===================================================================
--- trunk/mono/mono/metadata/loader.c 2007-12-31 18:28:15 UTC (rev 92068)
+++ trunk/mono/mono/metadata/loader.c 2007-12-31 18:35:12 UTC (rev 92069)
@@ -1340,6 +1340,11 @@
if (used_context) *used_context = FALSE;
+ if (idx > image->tables [MONO_TABLE_METHOD].rows) {
+ mono_loader_set_error_bad_image (g_strdup ("Bad method
token."));
+ return NULL;
+ }
+
mono_metadata_decode_row (&image->tables [MONO_TABLE_METHOD], idx - 1,
cols, 6);
if ((cols [2] & METHOD_ATTRIBUTE_PINVOKE_IMPL) ||
Modified: trunk/mono/mono/metadata/metadata.c
===================================================================
--- trunk/mono/mono/metadata/metadata.c 2007-12-31 18:28:15 UTC (rev 92068)
+++ trunk/mono/mono/metadata/metadata.c 2007-12-31 18:35:12 UTC (rev 92069)
@@ -954,7 +954,10 @@
{
guint32 bitfield = t->size_bitfield;
int i, count = mono_metadata_table_count (bitfield);
- const char *data = t->base + idx * t->row_size;
+ const char *data;
+
+ g_assert (idx < t->rows);
+ data = t->base + idx * t->row_size;
g_assert (res_size == count);
@@ -989,10 +992,12 @@
{
guint32 bitfield = t->size_bitfield;
int i;
- register const char *data = t->base + idx * t->row_size;
+ register const char *data;
register int n;
+ g_assert (idx < t->rows);
g_assert (col < mono_metadata_table_count (bitfield));
+ data = t->base + idx * t->row_size;
n = mono_metadata_table_size (bitfield, 0);
for (i = 0; i < col; ++i) {
_______________________________________________
Mono-patches maillist - [email protected]
http://lists.ximian.com/mailman/listinfo/mono-patches
