8343984: Fix Unsafe address overflow

wenshao · wenshao · commit 0dab920b7056 · 2024-11-13T23:17:26.000Z
Reviewed-by: pminborg, alanb
diff --git a/src/java.base/share/classes/java/lang/StringLatin1.java b/src/java.base/share/classes/java/lang/StringLatin1.java
@@ -830,22 +830,22 @@ static Stream<String> lines(byte[] value) {
     static void putCharsAt(byte[] val, int index, int c1, int c2, int c3, int c4) {
         assert index >= 0 && index + 3 < length(val) : "Trusted caller missed bounds check";
         // Don't use the putChar method, Its instrinsic will cause C2 unable to combining values into larger stores.
-        long address  = Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
-        UNSAFE.putByte(val, address    , (byte)(c1));
-        UNSAFE.putByte(val, address + 1, (byte)(c2));
-        UNSAFE.putByte(val, address + 2, (byte)(c3));
-        UNSAFE.putByte(val, address + 3, (byte)(c4));
+        long offset = (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
+        UNSAFE.putByte(val, offset    , (byte)(c1));
+        UNSAFE.putByte(val, offset + 1, (byte)(c2));
+        UNSAFE.putByte(val, offset + 2, (byte)(c3));
+        UNSAFE.putByte(val, offset + 3, (byte)(c4));
     }
 
     static void putCharsAt(byte[] val, int index, int c1, int c2, int c3, int c4, int c5) {
         assert index >= 0 && index + 4 < length(val) : "Trusted caller missed bounds check";
         // Don't use the putChar method, Its instrinsic will cause C2 unable to combining values into larger stores.
-        long address  = Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
-        UNSAFE.putByte(val, address    , (byte)(c1));
-        UNSAFE.putByte(val, address + 1, (byte)(c2));
-        UNSAFE.putByte(val, address + 2, (byte)(c3));
-        UNSAFE.putByte(val, address + 3, (byte)(c4));
-        UNSAFE.putByte(val, address + 4, (byte)(c5));
+        long offset  = (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
+        UNSAFE.putByte(val, offset    , (byte)(c1));
+        UNSAFE.putByte(val, offset + 1, (byte)(c2));
+        UNSAFE.putByte(val, offset + 2, (byte)(c3));
+        UNSAFE.putByte(val, offset + 3, (byte)(c4));
+        UNSAFE.putByte(val, offset + 4, (byte)(c5));
     }
 
     public static void putChar(byte[] val, int index, int c) {
diff --git a/src/java.base/share/classes/java/util/zip/ZipUtils.java b/src/java.base/share/classes/java/util/zip/ZipUtils.java
@@ -174,7 +174,7 @@ public static final int get16(byte[] b, int off) {
         Preconditions.checkIndex(off, b.length, Preconditions.AIOOBE_FORMATTER);
         Preconditions.checkIndex(off + 1, b.length, Preconditions.AIOOBE_FORMATTER);
         return Short.toUnsignedInt(
-                UNSAFE.getShortUnaligned(b, off + Unsafe.ARRAY_BYTE_BASE_OFFSET, false));
+                UNSAFE.getShortUnaligned(b, off + (long) Unsafe.ARRAY_BYTE_BASE_OFFSET, false));
     }
 
     /**
@@ -185,7 +185,7 @@ public static final long get32(byte[] b, int off) {
         Preconditions.checkIndex(off, b.length, Preconditions.AIOOBE_FORMATTER);
         Preconditions.checkIndex(off + 3, b.length, Preconditions.AIOOBE_FORMATTER);
         return Integer.toUnsignedLong(
-                UNSAFE.getIntUnaligned(b, off + Unsafe.ARRAY_BYTE_BASE_OFFSET, false));
+                UNSAFE.getIntUnaligned(b, off + (long) Unsafe.ARRAY_BYTE_BASE_OFFSET, false));
     }
 
     /**
@@ -195,7 +195,7 @@ public static final long get32(byte[] b, int off) {
     public static final long get64S(byte[] b, int off) {
         Preconditions.checkIndex(off, b.length, Preconditions.AIOOBE_FORMATTER);
         Preconditions.checkIndex(off + 7, b.length, Preconditions.AIOOBE_FORMATTER);
-        return UNSAFE.getLongUnaligned(b, off + Unsafe.ARRAY_BYTE_BASE_OFFSET, false);
+        return UNSAFE.getLongUnaligned(b, off + (long) Unsafe.ARRAY_BYTE_BASE_OFFSET, false);
     }
 
     /**
@@ -206,7 +206,7 @@ public static final long get64S(byte[] b, int off) {
     public static final int get32S(byte[] b, int off) {
         Preconditions.checkIndex(off, b.length, Preconditions.AIOOBE_FORMATTER);
         Preconditions.checkIndex(off + 3, b.length, Preconditions.AIOOBE_FORMATTER);
-        return UNSAFE.getIntUnaligned(b, off + Unsafe.ARRAY_BYTE_BASE_OFFSET, false);
+        return UNSAFE.getIntUnaligned(b, off + (long) Unsafe.ARRAY_BYTE_BASE_OFFSET, false);
     }
 
     /*
diff --git a/src/java.base/unix/classes/sun/nio/fs/UnixUserDefinedFileAttributeView.java b/src/java.base/unix/classes/sun/nio/fs/UnixUserDefinedFileAttributeView.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, 2022, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2008, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -194,7 +194,7 @@ public int read(String name, ByteBuffer dst) throws IOException {
                 int n = read(name, address, rem);
 
                 // copy from buffer into backing array
-                int off = dst.arrayOffset() + pos + Unsafe.ARRAY_BYTE_BASE_OFFSET;
+                long off = dst.arrayOffset() + pos + (long) Unsafe.ARRAY_BYTE_BASE_OFFSET;
                 unsafe.copyMemory(null, address, dst.array(), off, n);
                 dst.position(pos + n);
 
@@ -257,7 +257,7 @@ public int write(String name, ByteBuffer src) throws IOException {
 
                 if (src.hasArray()) {
                     // copy from backing array into buffer
-                    int off = src.arrayOffset() + pos + Unsafe.ARRAY_BYTE_BASE_OFFSET;
+                    long off = src.arrayOffset() + pos + (long) Unsafe.ARRAY_BYTE_BASE_OFFSET;
                     unsafe.copyMemory(src.array(), off, null, address, rem);
                 } else {
                     // backing array not accessible so transfer via temporary array
diff --git a/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/utilities/HeapHprofBinWriter.java b/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/utilities/HeapHprofBinWriter.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2004, 2022, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -1005,56 +1005,56 @@ protected void writePrimitiveArray(TypeArray array) throws IOException {
 
     private void writeBooleanArray(TypeArray array, int length) throws IOException {
         for (int index = 0; index < length; index++) {
-             long offset = BOOLEAN_BASE_OFFSET + index * BOOLEAN_SIZE;
+             long offset = (long) BOOLEAN_BASE_OFFSET + index * BOOLEAN_SIZE;
              out.writeBoolean(array.getHandle().getJBooleanAt(offset));
         }
     }
 
     private void writeByteArray(TypeArray array, int length) throws IOException {
         for (int index = 0; index < length; index++) {
-             long offset = BYTE_BASE_OFFSET + index * BYTE_SIZE;
+             long offset = (long) BYTE_BASE_OFFSET + index * BYTE_SIZE;
              out.writeByte(array.getHandle().getJByteAt(offset));
         }
     }
 
     private void writeShortArray(TypeArray array, int length) throws IOException {
         for (int index = 0; index < length; index++) {
-             long offset = SHORT_BASE_OFFSET + index * SHORT_SIZE;
+             long offset = (long) SHORT_BASE_OFFSET + index * SHORT_SIZE;
              out.writeShort(array.getHandle().getJShortAt(offset));
         }
     }
 
     private void writeIntArray(TypeArray array, int length) throws IOException {
         for (int index = 0; index < length; index++) {
-             long offset = INT_BASE_OFFSET + index * INT_SIZE;
+             long offset = (long) INT_BASE_OFFSET + index * INT_SIZE;
              out.writeInt(array.getHandle().getJIntAt(offset));
         }
     }
 
     private void writeLongArray(TypeArray array, int length) throws IOException {
         for (int index = 0; index < length; index++) {
-             long offset = LONG_BASE_OFFSET + index * LONG_SIZE;
+             long offset = (long) LONG_BASE_OFFSET + index * LONG_SIZE;
              out.writeLong(array.getHandle().getJLongAt(offset));
         }
     }
 
     private void writeCharArray(TypeArray array, int length) throws IOException {
         for (int index = 0; index < length; index++) {
-             long offset = CHAR_BASE_OFFSET + index * CHAR_SIZE;
+             long offset = (long) CHAR_BASE_OFFSET + index * CHAR_SIZE;
              out.writeChar(array.getHandle().getJCharAt(offset));
         }
     }
 
     private void writeFloatArray(TypeArray array, int length) throws IOException {
         for (int index = 0; index < length; index++) {
-             long offset = FLOAT_BASE_OFFSET + index * FLOAT_SIZE;
+             long offset = (long) FLOAT_BASE_OFFSET + index * FLOAT_SIZE;
              out.writeFloat(array.getHandle().getJFloatAt(offset));
         }
     }
 
     private void writeDoubleArray(TypeArray array, int length) throws IOException {
         for (int index = 0; index < length; index++) {
-             long offset = DOUBLE_BASE_OFFSET + index * DOUBLE_SIZE;
+             long offset = (long) DOUBLE_BASE_OFFSET + index * DOUBLE_SIZE;
              out.writeDouble(array.getHandle().getJDoubleAt(offset));
         }
     }
diff --git a/src/jdk.incubator.vector/share/classes/jdk/incubator/vector/ByteVector.java b/src/jdk.incubator.vector/share/classes/jdk/incubator/vector/ByteVector.java
@@ -4101,7 +4101,7 @@ static long booleanArrayAddress(boolean[] a, int index) {
 
     @ForceInline
     static long byteArrayAddress(byte[] a, int index) {
-        return Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
+        return (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
     }
 
     // ================================================
diff --git a/src/jdk.incubator.vector/share/classes/jdk/incubator/vector/DoubleVector.java b/src/jdk.incubator.vector/share/classes/jdk/incubator/vector/DoubleVector.java
@@ -3621,7 +3621,7 @@ static long arrayAddress(double[] a, int index) {
 
     @ForceInline
     static long byteArrayAddress(byte[] a, int index) {
-        return Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
+        return (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
     }
 
     // ================================================
diff --git a/src/jdk.incubator.vector/share/classes/jdk/incubator/vector/FloatVector.java b/src/jdk.incubator.vector/share/classes/jdk/incubator/vector/FloatVector.java
@@ -3571,7 +3571,7 @@ static long arrayAddress(float[] a, int index) {
 
     @ForceInline
     static long byteArrayAddress(byte[] a, int index) {
-        return Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
+        return (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
     }
 
     // ================================================
diff --git a/src/jdk.incubator.vector/share/classes/jdk/incubator/vector/IntVector.java b/src/jdk.incubator.vector/share/classes/jdk/incubator/vector/IntVector.java
@@ -3739,7 +3739,7 @@ static long arrayAddress(int[] a, int index) {
 
     @ForceInline
     static long byteArrayAddress(byte[] a, int index) {
-        return Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
+        return (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
     }
 
     // ================================================
diff --git a/src/jdk.incubator.vector/share/classes/jdk/incubator/vector/LongVector.java b/src/jdk.incubator.vector/share/classes/jdk/incubator/vector/LongVector.java
@@ -3674,7 +3674,7 @@ static long arrayAddress(long[] a, int index) {
 
     @ForceInline
     static long byteArrayAddress(byte[] a, int index) {
-        return Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
+        return (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
     }
 
     // ================================================
diff --git a/src/jdk.incubator.vector/share/classes/jdk/incubator/vector/ShortVector.java b/src/jdk.incubator.vector/share/classes/jdk/incubator/vector/ShortVector.java
@@ -4092,7 +4092,7 @@ static long charArrayAddress(char[] a, int index) {
 
     @ForceInline
     static long byteArrayAddress(byte[] a, int index) {
-        return Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
+        return (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
     }
 
     // ================================================
diff --git a/src/jdk.incubator.vector/share/classes/jdk/incubator/vector/X-Vector.java.template b/src/jdk.incubator.vector/share/classes/jdk/incubator/vector/X-Vector.java.template
@@ -5310,7 +5310,7 @@ public abstract class $abstractvectortype$ extends AbstractVector<$Boxtype$> {
 
     @ForceInline
     static long byteArrayAddress(byte[] a, int index) {
-        return Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
+        return (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;
     }
 
     // ================================================

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,5 @@`
`1`	`1`	`/*`
`2`		`- * Copyright (c) 2004, 2022, Oracle and/or its affiliates. All rights reserved.`
	`2`	`+ * Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.`
`3`	`3`	`* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.`
`4`	`4`	`*`
`5`	`5`	`* This code is free software; you can redistribute it and/or modify it`
`@@ -1005,56 +1005,56 @@ protected void writePrimitiveArray(TypeArray array) throws IOException {`
`1005`	`1005`
`1006`	`1006`	`private void writeBooleanArray(TypeArray array, int length) throws IOException {`
`1007`	`1007`	`for (int index = 0; index < length; index++) {`
`1008`		`- long offset = BOOLEAN_BASE_OFFSET + index * BOOLEAN_SIZE;`
	`1008`	`+ long offset = (long) BOOLEAN_BASE_OFFSET + index * BOOLEAN_SIZE;`
`1009`	`1009`	`out.writeBoolean(array.getHandle().getJBooleanAt(offset));`
`1010`	`1010`	`}`
`1011`	`1011`	`}`
`1012`	`1012`
`1013`	`1013`	`private void writeByteArray(TypeArray array, int length) throws IOException {`
`1014`	`1014`	`for (int index = 0; index < length; index++) {`
`1015`		`- long offset = BYTE_BASE_OFFSET + index * BYTE_SIZE;`
	`1015`	`+ long offset = (long) BYTE_BASE_OFFSET + index * BYTE_SIZE;`
`1016`	`1016`	`out.writeByte(array.getHandle().getJByteAt(offset));`
`1017`	`1017`	`}`
`1018`	`1018`	`}`
`1019`	`1019`
`1020`	`1020`	`private void writeShortArray(TypeArray array, int length) throws IOException {`
`1021`	`1021`	`for (int index = 0; index < length; index++) {`
`1022`		`- long offset = SHORT_BASE_OFFSET + index * SHORT_SIZE;`
	`1022`	`+ long offset = (long) SHORT_BASE_OFFSET + index * SHORT_SIZE;`
`1023`	`1023`	`out.writeShort(array.getHandle().getJShortAt(offset));`
`1024`	`1024`	`}`
`1025`	`1025`	`}`
`1026`	`1026`
`1027`	`1027`	`private void writeIntArray(TypeArray array, int length) throws IOException {`
`1028`	`1028`	`for (int index = 0; index < length; index++) {`
`1029`		`- long offset = INT_BASE_OFFSET + index * INT_SIZE;`
	`1029`	`+ long offset = (long) INT_BASE_OFFSET + index * INT_SIZE;`
`1030`	`1030`	`out.writeInt(array.getHandle().getJIntAt(offset));`
`1031`	`1031`	`}`
`1032`	`1032`	`}`
`1033`	`1033`
`1034`	`1034`	`private void writeLongArray(TypeArray array, int length) throws IOException {`
`1035`	`1035`	`for (int index = 0; index < length; index++) {`
`1036`		`- long offset = LONG_BASE_OFFSET + index * LONG_SIZE;`
	`1036`	`+ long offset = (long) LONG_BASE_OFFSET + index * LONG_SIZE;`
`1037`	`1037`	`out.writeLong(array.getHandle().getJLongAt(offset));`
`1038`	`1038`	`}`
`1039`	`1039`	`}`
`1040`	`1040`
`1041`	`1041`	`private void writeCharArray(TypeArray array, int length) throws IOException {`
`1042`	`1042`	`for (int index = 0; index < length; index++) {`
`1043`		`- long offset = CHAR_BASE_OFFSET + index * CHAR_SIZE;`
	`1043`	`+ long offset = (long) CHAR_BASE_OFFSET + index * CHAR_SIZE;`
`1044`	`1044`	`out.writeChar(array.getHandle().getJCharAt(offset));`
`1045`	`1045`	`}`
`1046`	`1046`	`}`
`1047`	`1047`
`1048`	`1048`	`private void writeFloatArray(TypeArray array, int length) throws IOException {`
`1049`	`1049`	`for (int index = 0; index < length; index++) {`
`1050`		`- long offset = FLOAT_BASE_OFFSET + index * FLOAT_SIZE;`
	`1050`	`+ long offset = (long) FLOAT_BASE_OFFSET + index * FLOAT_SIZE;`
`1051`	`1051`	`out.writeFloat(array.getHandle().getJFloatAt(offset));`
`1052`	`1052`	`}`
`1053`	`1053`	`}`
`1054`	`1054`
`1055`	`1055`	`private void writeDoubleArray(TypeArray array, int length) throws IOException {`
`1056`	`1056`	`for (int index = 0; index < length; index++) {`
`1057`		`- long offset = DOUBLE_BASE_OFFSET + index * DOUBLE_SIZE;`
	`1057`	`+ long offset = (long) DOUBLE_BASE_OFFSET + index * DOUBLE_SIZE;`
`1058`	`1058`	`out.writeDouble(array.getHandle().getJDoubleAt(offset));`
`1059`	`1059`	`}`
`1060`	`1060`	`}`
Original file line number	Diff line number	Diff line change
`@@ -4101,7 +4101,7 @@ static long booleanArrayAddress(boolean[] a, int index) {`
`4101`	`4101`
`4102`	`4102`	`@ForceInline`
`4103`	`4103`	`static long byteArrayAddress(byte[] a, int index) {`
`4104`		`- return Unsafe.ARRAY_BYTE_BASE_OFFSET + index;`
	`4104`	`+ return (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;`
`4105`	`4105`	`}`
`4106`	`4106`
`4107`	`4107`	`// ================================================`
Original file line number	Diff line number	Diff line change
`@@ -3621,7 +3621,7 @@ static long arrayAddress(double[] a, int index) {`
`3621`	`3621`
`3622`	`3622`	`@ForceInline`
`3623`	`3623`	`static long byteArrayAddress(byte[] a, int index) {`
`3624`		`- return Unsafe.ARRAY_BYTE_BASE_OFFSET + index;`
	`3624`	`+ return (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;`
`3625`	`3625`	`}`
`3626`	`3626`
`3627`	`3627`	`// ================================================`
Original file line number	Diff line number	Diff line change
`@@ -3571,7 +3571,7 @@ static long arrayAddress(float[] a, int index) {`
`3571`	`3571`
`3572`	`3572`	`@ForceInline`
`3573`	`3573`	`static long byteArrayAddress(byte[] a, int index) {`
`3574`		`- return Unsafe.ARRAY_BYTE_BASE_OFFSET + index;`
	`3574`	`+ return (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;`
`3575`	`3575`	`}`
`3576`	`3576`
`3577`	`3577`	`// ================================================`
Original file line number	Diff line number	Diff line change
`@@ -3739,7 +3739,7 @@ static long arrayAddress(int[] a, int index) {`
`3739`	`3739`
`3740`	`3740`	`@ForceInline`
`3741`	`3741`	`static long byteArrayAddress(byte[] a, int index) {`
`3742`		`- return Unsafe.ARRAY_BYTE_BASE_OFFSET + index;`
	`3742`	`+ return (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;`
`3743`	`3743`	`}`
`3744`	`3744`
`3745`	`3745`	`// ================================================`
Original file line number	Diff line number	Diff line change
`@@ -3674,7 +3674,7 @@ static long arrayAddress(long[] a, int index) {`
`3674`	`3674`
`3675`	`3675`	`@ForceInline`
`3676`	`3676`	`static long byteArrayAddress(byte[] a, int index) {`
`3677`		`- return Unsafe.ARRAY_BYTE_BASE_OFFSET + index;`
	`3677`	`+ return (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;`
`3678`	`3678`	`}`
`3679`	`3679`
`3680`	`3680`	`// ================================================`
Original file line number	Diff line number	Diff line change
`@@ -4092,7 +4092,7 @@ static long charArrayAddress(char[] a, int index) {`
`4092`	`4092`
`4093`	`4093`	`@ForceInline`
`4094`	`4094`	`static long byteArrayAddress(byte[] a, int index) {`
`4095`		`- return Unsafe.ARRAY_BYTE_BASE_OFFSET + index;`
	`4095`	`+ return (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;`
`4096`	`4096`	`}`
`4097`	`4097`
`4098`	`4098`	`// ================================================`
Original file line number	Diff line number	Diff line change
`@@ -5310,7 +5310,7 @@ public abstract class $abstractvectortype$ extends AbstractVector<$Boxtype$> {`
`5310`	`5310`
`5311`	`5311`	`@ForceInline`
`5312`	`5312`	`static long byteArrayAddress(byte[] a, int index) {`
`5313`		`- return Unsafe.ARRAY_BYTE_BASE_OFFSET + index;`
	`5313`	`+ return (long) Unsafe.ARRAY_BYTE_BASE_OFFSET + index;`
`5314`	`5314`	`}`
`5315`	`5315`
`5316`	`5316`	`// ================================================`