Re: verify.c

[Per Bothner <per@bothner.com>]

Guy Laden <guy@math.tau.ac.il> writes:

> In verify.c (line 450) I came across the comment:
> 
>       /* FIXME: If we exit a subroutine via a throw, we might
> 	 have returned to an earlier caller.  Obviously a
> 	 "ret" can only return one level, but a throw may
> 	 return many levels.*/
> 
> On the face of it this seems wrong: a 'ret' can return multiple
> levels (cf. the VM spec, 4.8.2 last item). Some tests with
> Sun's verifier show this to indeed be the case.

The comment is probably wrong according to the spec.  The real question
through is:  Is it ever useful to have code that returns multiple
level?  Does any compiler generate it?

And also:  Is the code wrong, or just the comment?  Does it reject
valid code or accept invalid code?  And in a way that matters - as
in generated by an existing compiler or obfuscator, or that it
allows an exploitable security hole.

> However I might be misunderstanding the comment as I'm reading
> it out of context, without a proper understanding of the code.

The handling of subroutines is the trickiest part of the verifier.
It took me quite a bit of work to get it to the current state.
There might well be further bugs in it.
--
	--Per Bothner
bothner@pacbell.net  per@bothner.com   http://home.pacbell.net/bothner/