1 /*
2  * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4  *
5  * This code is free software; you can redistribute it and/or modify it
6  * under the terms of the GNU General Public License version 2 only, as
7  * published by the Free Software Foundation.
8  *
9  * This code is distributed in the hope that it will be useful, but WITHOUT
10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
12  * version 2 for more details (a copy is included in the LICENSE file that
13  * accompanied this code).
14  *
15  * You should have received a copy of the GNU General Public License version
16  * 2 along with this work; if not, write to the Free Software Foundation,
17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18  *
19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20  * or visit www.oracle.com if you need additional information or have any
21  * questions.
22  *
23  */
24 
25 #include "precompiled.hpp"
26 #include "classfile/stackMapTable.hpp"
27 #include "classfile/verifier.hpp"
28 #include "memory/resourceArea.hpp"
29 #include "oops/constantPool.hpp"
30 #include "oops/oop.inline.hpp"
31 #include "runtime/handles.inline.hpp"
32 
StackMapTable(StackMapReader * reader,StackMapFrame * init_frame,u2 max_locals,u2 max_stack,char * code_data,int code_len,TRAPS)33 StackMapTable::StackMapTable(StackMapReader* reader, StackMapFrame* init_frame,
34                              u2 max_locals, u2 max_stack,
35                              char* code_data, int code_len, TRAPS) {
36   _code_length = code_len;
37   _frame_count = reader->get_frame_count();
38   if (_frame_count > 0) {
39     _frame_array = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD,
40                                                 StackMapFrame*, _frame_count);
41     StackMapFrame* pre_frame = init_frame;
42     for (int32_t i = 0; i < _frame_count; i++) {
43       StackMapFrame* frame = reader->next(
44         pre_frame, i == 0, max_locals, max_stack,
45         CHECK_VERIFY(pre_frame->verifier()));
46       _frame_array[i] = frame;
47       int offset = frame->offset();
48       if (offset >= code_len || code_data[offset] == 0) {
49         frame->verifier()->verify_error(
50             ErrorContext::bad_stackmap(i, frame),
51             "StackMapTable error: bad offset");
52         return;
53       }
54       pre_frame = frame;
55     }
56   }
57   reader->check_end(CHECK);
58 }
59 
60 // This method is only called by method in StackMapTable.
get_index_from_offset(int32_t offset) const61 int StackMapTable::get_index_from_offset(int32_t offset) const {
62   int i = 0;
63   for (; i < _frame_count; i++) {
64     if (_frame_array[i]->offset() == offset) {
65       return i;
66     }
67   }
68   return i;  // frame with offset doesn't exist in the array
69 }
70 
match_stackmap(StackMapFrame * frame,int32_t target,bool match,bool update,ErrorContext * ctx,TRAPS) const71 bool StackMapTable::match_stackmap(
72     StackMapFrame* frame, int32_t target,
73     bool match, bool update, ErrorContext* ctx, TRAPS) const {
74   int index = get_index_from_offset(target);
75   return match_stackmap(frame, target, index, match, update, ctx, THREAD);
76 }
77 
78 // Match and/or update current_frame to the frame in stackmap table with
79 // specified offset and frame index. Return true if the two frames match.
80 //
81 // The values of match and update are:                  _match__update
82 //
83 // checking a branch target:                             true   false
84 // checking an exception handler:                        true   false
85 // linear bytecode verification following an
86 // unconditional branch:                                 false  true
87 // linear bytecode verification not following an
88 // unconditional branch:                                 true   true
match_stackmap(StackMapFrame * frame,int32_t target,int32_t frame_index,bool match,bool update,ErrorContext * ctx,TRAPS) const89 bool StackMapTable::match_stackmap(
90     StackMapFrame* frame, int32_t target, int32_t frame_index,
91     bool match, bool update, ErrorContext* ctx, TRAPS) const {
92   if (frame_index < 0 || frame_index >= _frame_count) {
93     *ctx = ErrorContext::missing_stackmap(frame->offset());
94     frame->verifier()->verify_error(
95         *ctx, "Expecting a stackmap frame at branch target %d", target);
96     return false;
97   }
98 
99   StackMapFrame *stackmap_frame = _frame_array[frame_index];
100   bool result = true;
101   if (match) {
102     // Has direct control flow from last instruction, need to match the two
103     // frames.
104     result = frame->is_assignable_to(stackmap_frame,
105         ctx, CHECK_VERIFY_(frame->verifier(), result));
106   }
107   if (update) {
108     // Use the frame in stackmap table as current frame
109     int lsize = stackmap_frame->locals_size();
110     int ssize = stackmap_frame->stack_size();
111     if (frame->locals_size() > lsize || frame->stack_size() > ssize) {
112       // Make sure unused type array items are all _bogus_type.
113       frame->reset();
114     }
115     frame->set_locals_size(lsize);
116     frame->copy_locals(stackmap_frame);
117     frame->set_stack_size(ssize);
118     frame->copy_stack(stackmap_frame);
119     frame->set_flags(stackmap_frame->flags());
120   }
121   return result;
122 }
123 
check_jump_target(StackMapFrame * frame,int32_t target,TRAPS) const124 void StackMapTable::check_jump_target(
125     StackMapFrame* frame, int32_t target, TRAPS) const {
126   ErrorContext ctx;
127   bool match = match_stackmap(
128     frame, target, true, false, &ctx, CHECK_VERIFY(frame->verifier()));
129   if (!match || (target < 0 || target >= _code_length)) {
130     frame->verifier()->verify_error(ctx,
131         "Inconsistent stackmap frames at branch target %d", target);
132   }
133 }
134 
print_on(outputStream * str) const135 void StackMapTable::print_on(outputStream* str) const {
136   str->indent().print_cr("StackMapTable: frame_count = %d", _frame_count);
137   str->indent().print_cr("table = { ");
138   {
139     streamIndentor si(str);
140     for (int32_t i = 0; i < _frame_count; ++i) {
141       _frame_array[i]->print_on(str);
142     }
143   }
144   str->print_cr(" }");
145 }
146 
StackMapReader(ClassVerifier * v,StackMapStream * stream,char * code_data,int32_t code_len,TRAPS)147 StackMapReader::StackMapReader(ClassVerifier* v, StackMapStream* stream, char* code_data,
148                                int32_t code_len, TRAPS) :
149                                _verifier(v), _stream(stream),
150                                _code_data(code_data), _code_length(code_len) {
151   methodHandle m = v->method();
152   if (m->has_stackmap_table()) {
153     _cp = constantPoolHandle(THREAD, m->constants());
154     _frame_count = _stream->get_u2(CHECK);
155   } else {
156     // There's no stackmap table present. Frame count and size are 0.
157     _frame_count = 0;
158   }
159 }
160 
chop(VerificationType * locals,int32_t length,int32_t chops)161 int32_t StackMapReader::chop(
162     VerificationType* locals, int32_t length, int32_t chops) {
163   if (locals == NULL) return -1;
164   int32_t pos = length - 1;
165   for (int32_t i=0; i<chops; i++) {
166     if (locals[pos].is_category2_2nd()) {
167       pos -= 2;
168     } else {
169       pos --;
170     }
171     if (pos<0 && i<(chops-1)) return -1;
172   }
173   return pos+1;
174 }
175 
parse_verification_type(u1 * flags,TRAPS)176 VerificationType StackMapReader::parse_verification_type(u1* flags, TRAPS) {
177   u1 tag = _stream->get_u1(THREAD);
178   if (tag < (u1)ITEM_UninitializedThis) {
179     return VerificationType::from_tag(tag);
180   }
181   if (tag == ITEM_Object) {
182     u2 class_index = _stream->get_u2(THREAD);
183     int nconstants = _cp->length();
184     if ((class_index <= 0 || class_index >= nconstants) ||
185         (!_cp->tag_at(class_index).is_klass() &&
186          !_cp->tag_at(class_index).is_unresolved_klass())) {
187       _stream->stackmap_format_error("bad class index", THREAD);
188       return VerificationType::bogus_type();
189     }
190     return VerificationType::reference_type(_cp->klass_name_at(class_index));
191   }
192   if (tag == ITEM_UninitializedThis) {
193     if (flags != NULL) {
194       *flags |= FLAG_THIS_UNINIT;
195     }
196     return VerificationType::uninitialized_this_type();
197   }
198   if (tag == ITEM_Uninitialized) {
199     u2 offset = _stream->get_u2(THREAD);
200     if (offset >= _code_length ||
201         _code_data[offset] != ClassVerifier::NEW_OFFSET) {
202       _verifier->class_format_error(
203         "StackMapTable format error: bad offset for Uninitialized");
204       return VerificationType::bogus_type();
205     }
206     return VerificationType::uninitialized_type(offset);
207   }
208   _stream->stackmap_format_error("bad verification type", THREAD);
209   return VerificationType::bogus_type();
210 }
211 
next(StackMapFrame * pre_frame,bool first,u2 max_locals,u2 max_stack,TRAPS)212 StackMapFrame* StackMapReader::next(
213     StackMapFrame* pre_frame, bool first, u2 max_locals, u2 max_stack, TRAPS) {
214   StackMapFrame* frame;
215   int offset;
216   VerificationType* locals = NULL;
217   u1 frame_type = _stream->get_u1(THREAD);
218   if (frame_type < 64) {
219     // same_frame
220     if (first) {
221       offset = frame_type;
222       // Can't share the locals array since that is updated by the verifier.
223       if (pre_frame->locals_size() > 0) {
224         locals = NEW_RESOURCE_ARRAY_IN_THREAD(
225           THREAD, VerificationType, pre_frame->locals_size());
226       }
227     } else {
228       offset = pre_frame->offset() + frame_type + 1;
229       locals = pre_frame->locals();
230     }
231     frame = new StackMapFrame(
232       offset, pre_frame->flags(), pre_frame->locals_size(), 0,
233       max_locals, max_stack, locals, NULL, _verifier);
234     if (first && locals != NULL) {
235       frame->copy_locals(pre_frame);
236     }
237     return frame;
238   }
239   if (frame_type < 128) {
240     // same_locals_1_stack_item_frame
241     if (first) {
242       offset = frame_type - 64;
243       // Can't share the locals array since that is updated by the verifier.
244       if (pre_frame->locals_size() > 0) {
245         locals = NEW_RESOURCE_ARRAY_IN_THREAD(
246           THREAD, VerificationType, pre_frame->locals_size());
247       }
248     } else {
249       offset = pre_frame->offset() + frame_type - 63;
250       locals = pre_frame->locals();
251     }
252     VerificationType* stack = NEW_RESOURCE_ARRAY_IN_THREAD(
253       THREAD, VerificationType, 2);
254     u2 stack_size = 1;
255     stack[0] = parse_verification_type(NULL, CHECK_VERIFY_(_verifier, NULL));
256     if (stack[0].is_category2()) {
257       stack[1] = stack[0].to_category2_2nd();
258       stack_size = 2;
259     }
260     check_verification_type_array_size(
261       stack_size, max_stack, CHECK_VERIFY_(_verifier, NULL));
262     frame = new StackMapFrame(
263       offset, pre_frame->flags(), pre_frame->locals_size(), stack_size,
264       max_locals, max_stack, locals, stack, _verifier);
265     if (first && locals != NULL) {
266       frame->copy_locals(pre_frame);
267     }
268     return frame;
269   }
270 
271   u2 offset_delta = _stream->get_u2(THREAD);
272 
273   if (frame_type < SAME_LOCALS_1_STACK_ITEM_EXTENDED) {
274     // reserved frame types
275     _stream->stackmap_format_error(
276       "reserved frame type", CHECK_VERIFY_(_verifier, NULL));
277   }
278 
279   if (frame_type == SAME_LOCALS_1_STACK_ITEM_EXTENDED) {
280     // same_locals_1_stack_item_frame_extended
281     if (first) {
282       offset = offset_delta;
283       // Can't share the locals array since that is updated by the verifier.
284       if (pre_frame->locals_size() > 0) {
285         locals = NEW_RESOURCE_ARRAY_IN_THREAD(
286           THREAD, VerificationType, pre_frame->locals_size());
287       }
288     } else {
289       offset = pre_frame->offset() + offset_delta + 1;
290       locals = pre_frame->locals();
291     }
292     VerificationType* stack = NEW_RESOURCE_ARRAY_IN_THREAD(
293       THREAD, VerificationType, 2);
294     u2 stack_size = 1;
295     stack[0] = parse_verification_type(NULL, CHECK_VERIFY_(_verifier, NULL));
296     if (stack[0].is_category2()) {
297       stack[1] = stack[0].to_category2_2nd();
298       stack_size = 2;
299     }
300     check_verification_type_array_size(
301       stack_size, max_stack, CHECK_VERIFY_(_verifier, NULL));
302     frame = new StackMapFrame(
303       offset, pre_frame->flags(), pre_frame->locals_size(), stack_size,
304       max_locals, max_stack, locals, stack, _verifier);
305     if (first && locals != NULL) {
306       frame->copy_locals(pre_frame);
307     }
308     return frame;
309   }
310 
311   if (frame_type <= SAME_EXTENDED) {
312     // chop_frame or same_frame_extended
313     locals = pre_frame->locals();
314     int length = pre_frame->locals_size();
315     int chops = SAME_EXTENDED - frame_type;
316     int new_length = length;
317     u1 flags = pre_frame->flags();
318     if (chops != 0) {
319       new_length = chop(locals, length, chops);
320       check_verification_type_array_size(
321         new_length, max_locals, CHECK_VERIFY_(_verifier, NULL));
322       // Recompute flags since uninitializedThis could have been chopped.
323       flags = 0;
324       for (int i=0; i<new_length; i++) {
325         if (locals[i].is_uninitialized_this()) {
326           flags |= FLAG_THIS_UNINIT;
327           break;
328         }
329       }
330     }
331     if (first) {
332       offset = offset_delta;
333       // Can't share the locals array since that is updated by the verifier.
334       if (new_length > 0) {
335         locals = NEW_RESOURCE_ARRAY_IN_THREAD(
336           THREAD, VerificationType, new_length);
337       } else {
338         locals = NULL;
339       }
340     } else {
341       offset = pre_frame->offset() + offset_delta + 1;
342     }
343     frame = new StackMapFrame(
344       offset, flags, new_length, 0, max_locals, max_stack,
345       locals, NULL, _verifier);
346     if (first && locals != NULL) {
347       frame->copy_locals(pre_frame);
348     }
349     return frame;
350   } else if (frame_type < SAME_EXTENDED + 4) {
351     // append_frame
352     int appends = frame_type - SAME_EXTENDED;
353     int real_length = pre_frame->locals_size();
354     int new_length = real_length + appends*2;
355     locals = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, VerificationType, new_length);
356     VerificationType* pre_locals = pre_frame->locals();
357     int i;
358     for (i=0; i<pre_frame->locals_size(); i++) {
359       locals[i] = pre_locals[i];
360     }
361     u1 flags = pre_frame->flags();
362     for (i=0; i<appends; i++) {
363       locals[real_length] = parse_verification_type(&flags, THREAD);
364       if (locals[real_length].is_category2()) {
365         locals[real_length + 1] = locals[real_length].to_category2_2nd();
366         ++real_length;
367       }
368       ++real_length;
369     }
370     check_verification_type_array_size(
371       real_length, max_locals, CHECK_VERIFY_(_verifier, NULL));
372     if (first) {
373       offset = offset_delta;
374     } else {
375       offset = pre_frame->offset() + offset_delta + 1;
376     }
377     frame = new StackMapFrame(
378       offset, flags, real_length, 0, max_locals,
379       max_stack, locals, NULL, _verifier);
380     return frame;
381   }
382   if (frame_type == FULL) {
383     // full_frame
384     u1 flags = 0;
385     u2 locals_size = _stream->get_u2(THREAD);
386     int real_locals_size = 0;
387     if (locals_size > 0) {
388       locals = NEW_RESOURCE_ARRAY_IN_THREAD(
389         THREAD, VerificationType, locals_size*2);
390     }
391     int i;
392     for (i=0; i<locals_size; i++) {
393       locals[real_locals_size] = parse_verification_type(&flags, THREAD);
394       if (locals[real_locals_size].is_category2()) {
395         locals[real_locals_size + 1] =
396           locals[real_locals_size].to_category2_2nd();
397         ++real_locals_size;
398       }
399       ++real_locals_size;
400     }
401     check_verification_type_array_size(
402       real_locals_size, max_locals, CHECK_VERIFY_(_verifier, NULL));
403     u2 stack_size = _stream->get_u2(THREAD);
404     int real_stack_size = 0;
405     VerificationType* stack = NULL;
406     if (stack_size > 0) {
407       stack = NEW_RESOURCE_ARRAY_IN_THREAD(
408         THREAD, VerificationType, stack_size*2);
409     }
410     for (i=0; i<stack_size; i++) {
411       stack[real_stack_size] = parse_verification_type(NULL, THREAD);
412       if (stack[real_stack_size].is_category2()) {
413         stack[real_stack_size + 1] = stack[real_stack_size].to_category2_2nd();
414         ++real_stack_size;
415       }
416       ++real_stack_size;
417     }
418     check_verification_type_array_size(
419       real_stack_size, max_stack, CHECK_VERIFY_(_verifier, NULL));
420     if (first) {
421       offset = offset_delta;
422     } else {
423       offset = pre_frame->offset() + offset_delta + 1;
424     }
425     frame = new StackMapFrame(
426       offset, flags, real_locals_size, real_stack_size,
427       max_locals, max_stack, locals, stack, _verifier);
428     return frame;
429   }
430 
431   _stream->stackmap_format_error(
432     "reserved frame type", CHECK_VERIFY_(pre_frame->verifier(), NULL));
433   return NULL;
434 }
435