From 8590695f2d30e2ff1ccfca4decf48d17dc88f397 Mon Sep 17 00:00:00 2001
From: Joel Dice <joel.dice@gmail.com>
Date: Sun, 11 Mar 2012 05:00:08 -0600
Subject: [PATCH] constrain exception handler bounds to bytecode length

Scala occasionally generates exception handler tables with interval
bounds which fall outside the range of valid bytecode indexes, so we
must clamp them or risk out-of-bounds array accesses.
---
 src/compile.cpp | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/compile.cpp b/src/compile.cpp
index 4963212feb..2b415588db 100644
--- a/src/compile.cpp
+++ b/src/compile.cpp
@@ -6172,6 +6172,10 @@ logCompile(MyThread* t, const void* code, unsigned size, const char* class_,
 int
 resolveIpForwards(Context* context, int start, int end)
 {
+  if (start < 0) {
+    start = 0;
+  }
+
   while (start < end and context->visitTable[start] == 0) {
     ++ start;
   }
@@ -6186,6 +6190,13 @@ resolveIpForwards(Context* context, int start, int end)
 int
 resolveIpBackwards(Context* context, int start, int end)
 {
+  Thread* t = context->thread;
+  if (start >= static_cast<int>
+      (codeLength(t, methodCode(t, context->method))))
+  {
+    start = codeLength(t, methodCode(t, context->method)) - 1;
+  }
+
   while (start >= end and context->visitTable[start] == 0) {
     -- start;
   }
@@ -6269,11 +6280,16 @@ translateExceptionHandlerTable(MyThread* t, Context* context, intptr_t start)
          exceptionHandlerEnd(oldHandler));
 
       if (LIKELY(handlerStart >= 0)) {
+        assert(t, handlerStart < static_cast<int>
+               (codeLength(t, methodCode(t, context->method))));
+
         int handlerEnd = resolveIpBackwards
           (context, exceptionHandlerEnd(oldHandler),
            exceptionHandlerStart(oldHandler));
 
         assert(t, handlerEnd >= 0);
+        assert(t, handlerEnd < static_cast<int>
+               (codeLength(t, methodCode(t, context->method))));
 
         intArrayBody(t, newIndex, ni * 3)
           = c->machineIp(handlerStart)->value() - start;