Skip to content

Commit 7c06020

Browse files
authored
[mini] Fix the bounds check in GET_BBLOCK (#73493)
If the target IP is out of bounds, but `cfg->cil_offset_to_bb` has some non-zero data before or after it, then `tblock` will be some non-NULL pointer that we will treat as a good basic block. Related to #73474 (but doesn't fix the underlying issue there - it will just make the whole offending method throw a BadImageFormatException when it's called) This may have some performance overhead for the mono JIT.
1 parent d8dbd95 commit 7c06020

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/mono/mono/mini/method-to-ir.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -467,9 +467,9 @@ mini_set_inline_failure (MonoCompile *cfg, const char *msg)
467467
} while (0)
468468

469469
#define GET_BBLOCK(cfg,tblock,ip) do { \
470+
if ((ip) >= end || (ip) < header->code) { UNVERIFIED; } \
470471
(tblock) = cfg->cil_offset_to_bb [(ip) - cfg->cil_start]; \
471472
if (!(tblock)) { \
472-
if ((ip) >= end || (ip) < header->code) UNVERIFIED; \
473473
NEW_BBLOCK (cfg, (tblock)); \
474474
(tblock)->cil_code = (ip); \
475475
ADD_BBLOCK (cfg, (tblock)); \

0 commit comments

Comments
 (0)