Skip to content

Commit dfa869e

Browse files
committed
Java front-end: fix vector index type in populate_live_range_holes
CodeQL rightly complained that there is comparison using a more narrow type on the left-hand side of a less-than in a loop condition, which may give rise to a non-terminating loop in case of integer overflow. While at it, also add checks before unconditionally accessing the first element.
1 parent 79c1637 commit dfa869e

File tree

1 file changed

+5
-6
lines changed

1 file changed

+5
-6
lines changed

jbmc/src/java_bytecode/java_local_variable_table.cpp

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -513,18 +513,17 @@ static void populate_live_range_holes(
513513
merge_vars.begin(), merge_vars.end());
514514
std::sort(sorted_by_startpc.begin(), sorted_by_startpc.end(), lt_startpc);
515515

516+
PRECONDITION(!sorted_by_startpc.empty());
516517
maybe_add_hole(
517518
merge_into,
518519
expanded_live_range_start,
519520
sorted_by_startpc[0]->var.start_pc);
520-
for(java_bytecode_convert_methodt::method_offsett idx = 0;
521-
idx < sorted_by_startpc.size() - 1;
522-
++idx)
521+
for(auto it = sorted_by_startpc.begin() + 1; it != sorted_by_startpc.end();
522+
++it)
523523
{
524+
auto &local_var = (*std::prev(it))->var;
524525
maybe_add_hole(
525-
merge_into,
526-
sorted_by_startpc[idx]->var.start_pc+sorted_by_startpc[idx]->var.length,
527-
sorted_by_startpc[idx+1]->var.start_pc);
526+
merge_into, local_var.start_pc + local_var.length, (*it)->var.start_pc);
528527
}
529528
}
530529

0 commit comments

Comments
 (0)