Java程序  |  55行  |  2.01 KB

/*
 * Copyright (C) 2017 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

import java.lang.reflect.*;

public class Main {
  public static final String TEST_NAME = "998-redefine-use-after-free";
  public static final int REPS = 1000;
  public static final int STEP = 100;

  public static void main(String[] args) throws Exception {
    for (int i = 0; i < REPS; i += STEP) {
      runSeveralTimes(STEP);
    }
  }

  public static ClassLoader getClassLoaderFor(String location) throws Exception {
    try {
      Class<?> class_loader_class = Class.forName("dalvik.system.PathClassLoader");
      Constructor<?> ctor = class_loader_class.getConstructor(String.class, ClassLoader.class);
      return (ClassLoader)ctor.newInstance(location + "/" + TEST_NAME + "-ex.jar",
                                           Main.class.getClassLoader());
    } catch (ClassNotFoundException e) {
      // Running on RI. Use URLClassLoader.
      return new java.net.URLClassLoader(
          new java.net.URL[] { new java.net.URL("file://" + location + "/classes-ex/") });
    }
  }

  // Run the redefinition several times on a single class-loader to try to trigger the
  // Use-after-free bug b/62237378
  public static void runSeveralTimes(int times) throws Exception {
    ClassLoader c = getClassLoaderFor(System.getenv("DEX_LOCATION"));

    Class<?> klass = (Class<?>)c.loadClass("DexCacheSmash");
    Method m = klass.getDeclaredMethod("run");
    for (int i = 0 ; i < times; i++) {
      m.invoke(null);
    }
  }
}