JIT: Ensure no overflow in ContainBlockStoreAddress (#76532)

The offset here can be a "base" address due to various JIT transformations so we should ensure the range [offset, offset+size) does not overflow. Fix #76506
dotnet · Oct 3, 2022 · a45611a · a45611a
1 parent 56bbc7c
commit a45611a
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/src/coreclr/jit/lowerarmarch.cpp b/src/coreclr/jit/lowerarmarch.cpp
@@ -688,7 +688,12 @@ void Lowering::ContainBlockStoreAddress(GenTreeBlk* blkNode, unsigned size, GenT
     {
         return;
     }
-#endif // TARGET_ARM
+#else // !TARGET_ARM
+    if ((ClrSafeInt<int>(offset) + ClrSafeInt<int>(size)).IsOverflow())
+    {
+        return;
+    }
+#endif // !TARGET_ARM
 
     if (!IsSafeToContainMem(blkNode, addr))
     {