ART: Dex file verifier can't blindly use GetDescriptor

The dex file verifier cannot call GetDescriptor without checking
the index first.

Bug: 15615908
Change-Id: Iec5e20b77aac3e6c25fb94b1b630d0846c0b8f33

diff --git a/runtime/dex_file_verifier.cc b/runtime/dex_file_verifier.cc
index 3000217..291e2d0 100644 (file)
--- a/runtime/dex_file_verifier.cc
+++ b/runtime/dex_file_verifier.cc
@@ -1493,6 +1493,10 @@ bool DexFileVerifier::CheckInterProtoIdItem() {
 
   DexFileParameterIterator it(*dex_file_, *item);
   while (it.HasNext() && *shorty != '\0') {
+    if (!CheckIndex(it.GetTypeIdx(), dex_file_->NumTypeIds(),
+                    "inter_proto_id_item shorty type_idx")) {
+      return false;
+    }
     const char* descriptor = it.GetDescriptor();
     if (!CheckShortyDescriptorMatch(*shorty, descriptor, false)) {
       return false;