001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *   https://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing,
013 * software distributed under the License is distributed on an
014 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015 * KIND, either express or implied.  See the License for the
016 * specific language governing permissions and limitations
017 * under the License.
018 */
019package org.apache.bcel.generic;
020
021import java.io.DataOutputStream;
022import java.io.IOException;
023
024import org.apache.bcel.classfile.ClassFormatException;
025import org.apache.bcel.util.ByteSequence;
026
027/**
028 * TABLESWITCH - Switch within given range of values, that is, low..high
029 *
030 * @see SWITCH
031 */
032public class TABLESWITCH extends Select {
033
034    /**
035     * Empty constructor needed for Instruction.readInstruction. Not to be used otherwise.
036     */
037    TABLESWITCH() {
038    }
039
040    /**
041     * Constructs a TABLESWITCH instruction.
042     *
043     * @param match sorted array of match values, match[0] must be low value, match[match_length - 1] high value.
044     * @param targets where to branch for matched values.
045     * @param defaultTarget default branch.
046     */
047    public TABLESWITCH(final int[] match, final InstructionHandle[] targets, final InstructionHandle defaultTarget) {
048        super(org.apache.bcel.Const.TABLESWITCH, match, targets, defaultTarget);
049        /* Alignment remainder assumed 0 here, until dump time */
050        final short length = (short) (13 + getMatchLength() * 4);
051        super.setLength(length);
052        setFixedLength(length);
053    }
054
055    /**
056     * Call corresponding visitor method(s). The order is: Call visitor methods of implemented interfaces first, then call
057     * methods according to the class hierarchy in descending order, that is, the most specific visitXXX() call comes last.
058     *
059     * @param v Visitor object.
060     */
061    @Override
062    public void accept(final Visitor v) {
063        v.visitVariableLengthInstruction(this);
064        v.visitStackConsumer(this);
065        v.visitBranchInstruction(this);
066        v.visitSelect(this);
067        v.visitTABLESWITCH(this);
068    }
069
070    /**
071     * Dumps instruction as byte code to stream out.
072     *
073     * @param out Output stream.
074     */
075    @Override
076    public void dump(final DataOutputStream out) throws IOException {
077        super.dump(out);
078        final int matchLength = getMatchLength();
079        final int low = matchLength > 0 ? super.getMatch(0) : 0;
080        out.writeInt(low);
081        final int high = matchLength > 0 ? super.getMatch(matchLength - 1) : 0;
082        out.writeInt(high);
083        for (int i = 0; i < matchLength; i++) {
084            out.writeInt(setIndices(i, getTargetOffset(super.getTarget(i))));
085        }
086    }
087
088    /**
089     * Reads needed data (for example index) from file.
090     */
091    @Override
092    protected void initFromFile(final ByteSequence bytes, final boolean wide) throws IOException {
093        super.initFromFile(bytes, wide);
094        final int low = bytes.readInt();
095        final int high = bytes.readInt();
096        // Compute in long arithmetic to guard against integer overflow, and require the match table to actually fit into the remaining code bytes (4 bytes
097        // per jump offset). The low and high fields are attacker-controlled in a malicious class file and could otherwise request a multi-gigabyte
098        // allocation, or a negative array size, before a single table entry is read.
099        final long matchLengthLong = (long) high - low + 1;
100        if (matchLengthLong < 0 || matchLengthLong > bytes.available() / 4) {
101            throw new ClassFormatException(
102                    "Invalid tableswitch: low=" + low + ", high=" + high + ", but only " + bytes.available() + " bytes of code remain.");
103        }
104        final int matchLength = (int) matchLengthLong;
105        setMatchLength(matchLength);
106        final short fixedLength = (short) (13 + matchLength * 4);
107        setFixedLength(fixedLength);
108        super.setLength((short) (fixedLength + super.getPadding()));
109        super.setMatches(new int[matchLength]);
110        super.setIndices(new int[matchLength]);
111        super.setTargets(new InstructionHandle[matchLength]);
112        for (int i = 0; i < matchLength; i++) {
113            super.setMatch(i, low + i);
114            super.setIndices(i, bytes.readInt());
115        }
116    }
117}