commit dd3208d3b2f4b78678a341f38a5cc7761c7fca91
author Logan Chien <tzuhsiang.chien@gmail.com> Sun Apr 19 23:27:52 2015 +0800
committer Andreas Gampe <agampe@google.com> Fri Apr 24 20:42:52 2015 -0700
tree 5657ce4afd75cff76c472b23b684a89ef1e141b5
parent 940c65d6757130d2e9f864d4c2220838f0312bea

ART: Fix DBG_START_LOCAL verification.

The third ULEB128 of DBG_START_LOCAL and DBG_START_LOCAL_EXTENDED
entries should be interpreted as type_idx instead.

see also. dalvik/dx/src/com/android/dx/dex/file/DebugInfoEncoder.java

Change-Id: Ic0d52ed20cc2614acb9fa54b61095d1bd64f73fe

runtime/dex_file_verifier.cc

diff --git a/runtime/dex_file_verifier.cc b/runtime/dex_file_verifier.cc
index 2603975..a66c38e 100644
--- a/runtime/dex_file_verifier.cc
+++ b/runtime/dex_file_verifier.cc
@@ -944,7 +944,7 @@
         uint32_t type_idx = DecodeUnsignedLeb128(&ptr_);
         if (type_idx != 0) {
           type_idx--;
-          if (!CheckIndex(type_idx, header_->string_ids_size_, "DBG_START_LOCAL type_idx")) {
+          if (!CheckIndex(type_idx, header_->type_ids_size_, "DBG_START_LOCAL type_idx")) {
             return false;
           }
         }
@@ -975,7 +975,7 @@
         uint32_t type_idx = DecodeUnsignedLeb128(&ptr_);
         if (type_idx != 0) {
           type_idx--;
-          if (!CheckIndex(type_idx, header_->string_ids_size_, "DBG_START_LOCAL_EXTENDED type_idx")) {
+          if (!CheckIndex(type_idx, header_->type_ids_size_, "DBG_START_LOCAL_EXTENDED type_idx")) {
             return false;
           }
         }