commit 5d01b43ec63c5cdd20528b9adf99660ce4724cbc
author Jinseong Jeon <jsjeon@google.com> Thu Feb 06 21:48:14 2020 -0800
committer Jinseong Jeon <jsjeon@google.com> Thu Feb 06 21:48:14 2020 -0800
tree b3b5396d3732bbffc6a708e5ca07ef4f74a7a0ed
parent fff98aac2e3238270f68c606fe4b2b2062cdce0c

Fix out of bound error in DescriptorUtils#getArgumentCount.

Change-Id: I5c8963fc720cd4fe0da685f7c6f57e9e5243ab63

src/main/java/com/android/tools/r8/utils/DescriptorUtils.java

diff --git a/src/main/java/com/android/tools/r8/utils/DescriptorUtils.java b/src/main/java/com/android/tools/r8/utils/DescriptorUtils.java
index b532e50..51ab446 100644
--- a/src/main/java/com/android/tools/r8/utils/DescriptorUtils.java
+++ b/src/main/java/com/android/tools/r8/utils/DescriptorUtils.java
@@ -639,7 +639,8 @@
           break;
         case '[':
           startType = charIdx;
-          while (methodDescriptor.charAt(++charIdx) == '[') {}
+          while (methodDescriptor.charAt(++charIdx) == '[')
+            ;
           if (methodDescriptor.charAt(charIdx) == 'L') {
             while (methodDescriptor.charAt(++charIdx) != ';')
               ;
@@ -661,19 +662,25 @@
   }
 
   public static int getArgumentCount(final String methodDescriptor) {
+    int length = methodDescriptor.length();
     int charIdx = 1;
     char c;
     int argCount = 0;
-    while (charIdx < methodDescriptor.length() && (c = methodDescriptor.charAt(charIdx++)) != ')') {
+    while (charIdx < length && (c = methodDescriptor.charAt(charIdx++)) != ')') {
       if (c == 'L') {
-        while (methodDescriptor.charAt(charIdx++) != ';')
+        while (charIdx < length && methodDescriptor.charAt(charIdx++) != ';')
           ;
+        // Check if the inner loop found ';' within the boundary.
+        if (charIdx >= length || methodDescriptor.charAt(charIdx - 1) != ';') {
+          throw new InvalidDescriptorException(methodDescriptor);
+        }
         argCount++;
       } else if (c != '[') {
         argCount++;
       }
     }
-    if (charIdx >= methodDescriptor.length() || methodDescriptor.charAt(charIdx - 1) != ')') {
+    // Check if the outer loop found ')' within the boundary.
+    if (charIdx >= length || methodDescriptor.charAt(charIdx - 1) != ')') {
       throw new InvalidDescriptorException(methodDescriptor);
     }
     return argCount;