[BCEL-124] tableswitch/lookupswitch invalid alignment of 4-byte operands

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.2
• Fix Version/s: 6.0
• Component/s: Main

Environment

Operating System: All
Platform: All

• External issue URL: https://issues.apache.org/bugzilla/show_bug.cgi?id=45230
• External issue ID: 45230
• Assignee: Apache Commons Developers
• Reporter: Timothy Alper
• Created: 18/Jun/08 15:23
• Updated: 14/Jul/16 12:48
• Resolved: 10/Jan/10 13:22

Description

It is possible, with BCEL, to generate invalid alignment of the 4-byte operands of the Select instructions. The problem is caused by the interaction of InstructionList.setPositions, the updatePosition methods of GOTO and JSR, and Select.updatePosition.

In particular, the updatePosition methods of GOTO and JSR will always return the difference between the wide instruction length and the normal instruction length. Since this value ends up being added into the additional_bytes variable in InstructionList.setPositions and then eventually contributes to the value passed into Select.updatePosition as the offset, its incorrect value causes the padding field to be set incorrectly.

It appears that in order to behave properly, the updatePosition method should return only the number of bytes of length that the instruction changed during this call to updatePosition.

I am attaching a small example application that displays the bug.

I will also be attaching a patch.