[vmkit-commits] [vmkit] r198520 - fix a bug for array bound check in arraycopy

[Gael Thomas]

Author: gthomas
Date: Sat Jan  4 17:16:46 2014
New Revision: 198520

URL: http://llvm.org/viewvc/llvm-project?rev=198520&view=rev
Log:
fix a bug for array bound check in arraycopy

Modified:
    vmkit/branches/mcjit/lib/j3/openjdk/j3openjdk.cc

Modified: vmkit/branches/mcjit/lib/j3/openjdk/j3openjdk.cc
URL: http://llvm.org/viewvc/llvm-project/vmkit/branches/mcjit/lib/j3/openjdk/j3openjdk.cc?rev=198520&r1=198519&r2=198520&view=diff
==============================================================================
--- vmkit/branches/mcjit/lib/j3/openjdk/j3openjdk.cc (original)
+++ vmkit/branches/mcjit/lib/j3/openjdk/j3openjdk.cc Sat Jan  4 17:16:46 2014
@@ -86,8 +86,9 @@ void JNICALL JVM_ArrayCopy(JNIEnv* env,
 	if(!srcType0->isArrayClass() || !dstType0->isArrayClass() || !srcType0->isAssignableTo(dstType0))
 		J3::arrayStoreException();
 
-	if(src_pos >= src->arrayLength() || 
-		 dst_pos >= dst->arrayLength() ||
+	//fprintf(stderr, " array copy: [%d %d %d] [%d %d %d]\n", src_pos, length, src->arrayLength(), dst_pos, length, dst->arrayLength());
+	if(src_pos < 0 || 
+		 dst_pos < 0 ||
 		 (src_pos + length) > src->arrayLength() ||
 		 (dst_pos + length) > dst->arrayLength())
 		J3::arrayIndexOutOfBoundsException();