[GR-18003] System.arraycopy bounds check overflow for virtualized arr…

…ays. PullRequest: graal/4328
happylynx · Sep 4, 2019 · 9abe878 · 9abe878
2 parents 3287cd4 + a2d14e2
commit 9abe878
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/...compiler.replacements/src/org/graalvm/compiler/replacements/nodes/BasicArrayCopyNode.java b/...compiler.replacements/src/org/graalvm/compiler/replacements/nodes/BasicArrayCopyNode.java
@@ -144,7 +144,8 @@ public void lower(LoweringTool tool) {
     }
 
     private static boolean checkBounds(int position, int length, VirtualObjectNode virtualObject) {
-        return position >= 0 && position + length <= virtualObject.entryCount();
+        assert length >= 0;
+        return position >= 0 && position <= virtualObject.entryCount() - length;
     }
 
     private static boolean checkEntryTypes(int srcPos, int length, VirtualObjectNode src, ResolvedJavaType destComponentType, VirtualizerTool tool) {