2004-05-25 Sebastien Pouliot <sebastien@ximian.com>

	* Array.cs: Fixed possible integer overflow.
	* BitConverter.cs: Fixed a possible integer overflow in ToString.

svn path=/trunk/mcs/; revision=28070

diff --git a/mcs/class/corlib/System/Array.cs b/mcs/class/corlib/System/Array.cs
index 77a55ab02ca78cb24b6f6d9cfc8d2d8cc1ffac92..6c95f288974b5a6796e9ab85de47c1a9dd68774f 100644 (file)
--- a/mcs/class/corlib/System/Array.cs
+++ b/mcs/class/corlib/System/Array.cs
@@ -523,7 +523,8 @@ namespace System
                        if (length < 0)
                                throw new ArgumentOutOfRangeException ("length", Locale.GetText (
                                        "Value has to be >= 0."));
-                       if (index + length > array.GetLowerBound (0) + array.GetLength (0))
+                       // re-ordered to avoid possible integer overflow
+                       if (index > array.GetLowerBound (0) + array.GetLength (0) - length)
                                throw new ArgumentException (Locale.GetText (
                                        "index and length do not specify a valid range in array."));
                        if (!(value is IComparable))
@@ -547,7 +548,8 @@ namespace System
                        if (length < 0)
                                throw new ArgumentOutOfRangeException ("length", Locale.GetText (
                                        "Value has to be >= 0."));
-                       if (index + length > array.GetLowerBound (0) + array.GetLength (0))
+                       // re-ordered to avoid possible integer overflow
+                       if (index > array.GetLowerBound (0) + array.GetLength (0) - length)
                                throw new ArgumentException (Locale.GetText (
                                        "index and length do not specify a valid range in array."));
 
@@ -604,7 +606,8 @@ namespace System
                                throw new IndexOutOfRangeException ("index < lower bound");
                        index = index - low;
 
-                       if (index + length > array.Length)
+                       // re-ordered to avoid possible integer overflow
+                       if (index > array.Length - length)
                                throw new IndexOutOfRangeException ("index + length > size");
 
                        for (int i = 0; i < length; i++) 
@@ -654,7 +657,8 @@ namespace System
                        int source_pos = sourceIndex - sourceArray.GetLowerBound (0);
                        int dest_pos = destinationIndex - destinationArray.GetLowerBound (0);
 
-                       if (source_pos + length > sourceArray.Length || dest_pos + length > destinationArray.Length)
+                       // re-ordered to avoid possible integer overflow
+                       if (source_pos > sourceArray.Length - length || dest_pos > destinationArray.Length - length)
                                throw new ArgumentException ("length");
 
                        if (sourceArray.Rank != destinationArray.Rank)
@@ -756,7 +760,8 @@ namespace System
                        if (array.Rank > 1)
                                throw new RankException (Locale.GetText ("Only single dimension arrays are supported."));
 
-                       if (count < 0 || startIndex < array.GetLowerBound (0) || startIndex + count - 1 > array.GetUpperBound (0))
+                       // re-ordered to avoid possible integer overflow
+                       if (count < 0 || startIndex < array.GetLowerBound (0) || startIndex - 1 > array.GetUpperBound (0) - count)
                                throw new ArgumentOutOfRangeException ();
 
                        int max = startIndex + count;
@@ -832,7 +837,8 @@ namespace System
                        if (index < array.GetLowerBound (0) || length < 0)
                                throw new ArgumentOutOfRangeException ();
 
-                       if (index + length > array.GetUpperBound (0) + 1)
+                       // re-ordered to avoid possible integer overflow
+                       if (index > array.GetUpperBound (0) + 1 - length)
                                throw new ArgumentException ();
 
                        for (int i = 0; i < length / 2; i++)

diff --git a/mcs/class/corlib/System/BitConverter.cs b/mcs/class/corlib/System/BitConverter.cs
index 38d3a20a09cb5244724454b68c8250ce8555500f..496d07948cecce87bf336e8c584be0d32d9067b0 100755 (executable)
--- a/mcs/class/corlib/System/BitConverter.cs
+++ b/mcs/class/corlib/System/BitConverter.cs
@@ -247,9 +247,12 @@ namespace System
                        // was added as a small fix to a very obscure bug.
                        // It makes a small difference when start_index is
                        // outside the range and length==0. 
-                       if (startIndex < 0 || length < 0 || startIndex + length > value.Length || startIndex >= value.Length) {
+                       if (startIndex < 0 || length < 0 || startIndex >= value.Length)
                                throw new ArgumentOutOfRangeException ("startIndex");
-                       }
+                       // note: re-ordered to avoid possible integer overflow
+                       if (startIndex > value.Length - length)
+                               throw new ArgumentException ("startIndex + length > value.Length");
+
                        string ret = "";
                        int end = startIndex + length;
 

diff --git a/mcs/class/corlib/System/ChangeLog b/mcs/class/corlib/System/ChangeLog
index e99d63fac73b247fdf838979c71007c5c649af8c..12725ec57b7e7815601c69818fea591234e2525b 100644 (file)
--- a/mcs/class/corlib/System/ChangeLog
+++ b/mcs/class/corlib/System/ChangeLog
@@ -1,5 +1,7 @@
 2004-05-25  Sebastien Pouliot  <sebastien@ximian.com>
 
+       * Array.cs: Fixed possible integer overflow.
+       * BitConverter.cs: Fixed a possible integer overflow in ToString.
        * Guid.cs: Added an internal method to create a random Guid without
        using CryptoConfig (which is heavy on first use). This is only used
        in S.R.E.ModuleBuilder to speedup MCS compilation.