On Thu, 11 Jun 2026 12:08:27 GMT, Casper Norrbin <[email protected]> wrote:
> Hi everyone, > > This fixes an overflow in `FlatArrayPayload::advance_index`. The method > advanced an array payload offset by multiplying two `int` values before > adding the result to a `ptrdiff_t`. For large flat arrays, the > backward-overlap path in `FlatArrayKlass::copy_array` can call > `advance_index(length - 1)`, and that multiplication can overflow before the > value is widened. > > The fix widens the operands before multiplying, so the offset adjustment is > computed in a `ptrdiff_t`. > > I also added a regression test that performs large overlapping copies on a > flat value array. Before the fix, the backward overlapping copy fails in > debug builds with an out-of-bounds assert. With the fix, both backward and > forward overlapping copies complete successfully. > > Testing: > - New test testing same-array flat copy behavior > - Tiers 1-3 > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). This pull request has now been integrated. Changeset: 6eb965bb Author: Casper Norrbin <[email protected]> Committer: Frederic Parain <[email protected]> URL: https://git.openjdk.org/valhalla/commit/6eb965bbd0026ea1eb1b43e4b92e36f3f945b33d Stats: 78 lines in 2 files changed: 77 ins; 0 del; 1 mod 8386342: [lworld] Large overlapping flat arraycopy overflows payload offset Reviewed-by: jsjolen, fparain, jsikstro ------------- PR: https://git.openjdk.org/valhalla/pull/2537
