commit 380aaa74da9f0086b89b6032e7909ead4fa607f2
author Elliott Hughes <enh@google.com> Mon Jul 09 14:33:15 2012 -0700
committer Elliott Hughes <enh@google.com> Mon Jul 09 14:47:51 2012 -0700
tree 4ddda528ed001493e4e9d9d08d35f0e88524cc7a
parent 44a25bbc4626119d24d2cb7378212b6fd0093c19

Fix a possible off-by-one in the verifier.

The art version of 0bd15512ca35f8c77d743166807ce60684f21123.

Bug: http://code.google.com/p/android/issues/detail?id=10863
Change-Id: I633b8731d06c83d992229a5831176f0a2ae47046

src/verifier/method_verifier.cc

diff --git a/src/verifier/method_verifier.cc b/src/verifier/method_verifier.cc
index 0a487e3..cc01224 100644
--- a/src/verifier/method_verifier.cc
+++ b/src/verifier/method_verifier.cc
@@ -1268,7 +1268,7 @@
       if (insns[insn_idx] == Instruction::kPackedSwitchSignature ||
           insns[insn_idx] == Instruction::kSparseSwitchSignature ||
           insns[insn_idx] == Instruction::kArrayDataSignature ||
-          (insns[insn_idx] == Instruction::NOP &&
+          (insns[insn_idx] == Instruction::NOP && (insn_idx + 1 < insns_size) &&
            (insns[insn_idx + 1] == Instruction::kPackedSwitchSignature ||
             insns[insn_idx + 1] == Instruction::kSparseSwitchSignature ||
             insns[insn_idx + 1] == Instruction::kArrayDataSignature))) {