From: Sebastien Pouliot <sebastien@ximian.com>
Date: Tue, 25 May 2004 18:59:35 +0000 (-0000)
Subject: 2004-05-25  Sebastien Pouliot  <sebastien@ximian.com>
X-Git-Url: http://wien.tomnetworks.com/gitweb/?a=commitdiff_plain;h=47ec8815dfb477ec75913eb6eea76c774bcd4c50;p=mono.git

2004-05-25  Sebastien Pouliot  <sebastien@ximian.com>

	* Array.cs: Fixed possible integer overflow.
	* BitConverter.cs: Fixed a possible integer overflow in ToString.

svn path=/trunk/mcs/; revision=28070
---

diff --git a/mcs/class/corlib/System/Array.cs b/mcs/class/corlib/System/Array.cs
index 77a55ab02ca..6c95f288974 100644
--- a/mcs/class/corlib/System/Array.cs
+++ b/mcs/class/corlib/System/Array.cs
@@ -523,7 +523,8 @@ namespace System
 			if (length < 0)
 				throw new ArgumentOutOfRangeException ("length", Locale.GetText (
 					"Value has to be >= 0."));
-			if (index + length > array.GetLowerBound (0) + array.GetLength (0))
+			// re-ordered to avoid possible integer overflow
+			if (index > array.GetLowerBound (0) + array.GetLength (0) - length)
 				throw new ArgumentException (Locale.GetText (
 					"index and length do not specify a valid range in array."));
 			if (!(value is IComparable))
@@ -547,7 +548,8 @@ namespace System
 			if (length < 0)
 				throw new ArgumentOutOfRangeException ("length", Locale.GetText (
 					"Value has to be >= 0."));
-			if (index + length > array.GetLowerBound (0) + array.GetLength (0))
+			// re-ordered to avoid possible integer overflow
+			if (index > array.GetLowerBound (0) + array.GetLength (0) - length)
 				throw new ArgumentException (Locale.GetText (
 					"index and length do not specify a valid range in array."));
 
@@ -604,7 +606,8 @@ namespace System
 				throw new IndexOutOfRangeException ("index < lower bound");
 			index = index - low;
 
-			if (index + length > array.Length)
+			// re-ordered to avoid possible integer overflow
+			if (index > array.Length - length)
 				throw new IndexOutOfRangeException ("index + length > size");
 
 			for (int i = 0; i < length; i++) 
@@ -654,7 +657,8 @@ namespace System
 			int source_pos = sourceIndex - sourceArray.GetLowerBound (0);
 			int dest_pos = destinationIndex - destinationArray.GetLowerBound (0);
 
-			if (source_pos + length > sourceArray.Length || dest_pos + length > destinationArray.Length)
+			// re-ordered to avoid possible integer overflow
+			if (source_pos > sourceArray.Length - length || dest_pos > destinationArray.Length - length)
 				throw new ArgumentException ("length");
 
 			if (sourceArray.Rank != destinationArray.Rank)
@@ -756,7 +760,8 @@ namespace System
 			if (array.Rank > 1)
 				throw new RankException (Locale.GetText ("Only single dimension arrays are supported."));
 
-			if (count < 0 || startIndex < array.GetLowerBound (0) || startIndex + count - 1 > array.GetUpperBound (0))
+			// re-ordered to avoid possible integer overflow
+			if (count < 0 || startIndex < array.GetLowerBound (0) || startIndex - 1 > array.GetUpperBound (0) - count)
 				throw new ArgumentOutOfRangeException ();
 
 			int max = startIndex + count;
@@ -832,7 +837,8 @@ namespace System
 			if (index < array.GetLowerBound (0) || length < 0)
 				throw new ArgumentOutOfRangeException ();
 
-			if (index + length > array.GetUpperBound (0) + 1)
+			// re-ordered to avoid possible integer overflow
+			if (index > array.GetUpperBound (0) + 1 - length)
 				throw new ArgumentException ();
 
 			for (int i = 0; i < length / 2; i++)
diff --git a/mcs/class/corlib/System/BitConverter.cs b/mcs/class/corlib/System/BitConverter.cs
index 38d3a20a09c..496d07948ce 100755
--- a/mcs/class/corlib/System/BitConverter.cs
+++ b/mcs/class/corlib/System/BitConverter.cs
@@ -247,9 +247,12 @@ namespace System
 			// was added as a small fix to a very obscure bug.
 			// It makes a small difference when start_index is
 			// outside the range and length==0. 
-			if (startIndex < 0 || length < 0 || startIndex + length > value.Length || startIndex >= value.Length) {
+			if (startIndex < 0 || length < 0 || startIndex >= value.Length)
 				throw new ArgumentOutOfRangeException ("startIndex");
-			}
+			// note: re-ordered to avoid possible integer overflow
+			if (startIndex > value.Length - length)
+				throw new ArgumentException ("startIndex + length > value.Length");
+
 			string ret = "";
 			int end = startIndex + length;
 
diff --git a/mcs/class/corlib/System/ChangeLog b/mcs/class/corlib/System/ChangeLog
index e99d63fac73..12725ec57b7 100644
--- a/mcs/class/corlib/System/ChangeLog
+++ b/mcs/class/corlib/System/ChangeLog
@@ -1,5 +1,7 @@
 2004-05-25  Sebastien Pouliot  <sebastien@ximian.com>
 
+	* Array.cs: Fixed possible integer overflow.
+	* BitConverter.cs: Fixed a possible integer overflow in ToString.
 	* Guid.cs: Added an internal method to create a random Guid without
 	using CryptoConfig (which is heavy on first use). This is only used
 	in S.R.E.ModuleBuilder to speedup MCS compilation.