{"record":{"id":"66e41d47f237bf93","repo":"Tencent/tinker","slug":"codeaddress-d-out-of-bounds","errorCode":null,"errorMessage":"codeAddress %d out of bounds","messagePattern":"codeAddress (.+?) out of bounds","errorType":"exception","errorClass":"IndexOutOfBoundsException","httpStatus":null,"severity":"critical","filePath":"tinker-build/tinker-patch-lib/src/main/java/org/jf/dexlib2/builder/BuilderMutableMethodImplementation.java","lineNumber":623,"sourceCode":"        if (guessedLocation.codeAddress == codeAddress) {\n            return index;\n        } else if (guessedLocation.codeAddress > codeAddress) {\n            do {\n                index--;\n            } while (instructionList.get(index).codeAddress > codeAddress);\n            return index;\n        } else {\n            do {\n                index++;\n            } while (index < instructionList.size() && instructionList.get(index).codeAddress <= codeAddress);\n            return index - 1;\n        }\n    }\n\n    @Nonnull\n    public Label newLabelForAddress(int codeAddress) {\n        if (codeAddress < 0 || codeAddress > instructionList.get(instructionList.size() - 1).codeAddress) {\n            throw new IndexOutOfBoundsException(String.format(\"codeAddress %d out of bounds\", codeAddress));\n        }\n        MethodLocation referent = instructionList.get(mapCodeAddressToIndex(codeAddress));\n        return referent.addNewLabel();\n    }\n\n    @Nonnull\n    public Label newLabelForIndex(int instructionIndex) {\n        if (instructionIndex < 0 || instructionIndex >= instructionList.size()) {\n            throw new IndexOutOfBoundsException(String.format(\"instruction index %d out of bounds\", instructionIndex));\n        }\n        MethodLocation referent = instructionList.get(instructionIndex);\n        return referent.addNewLabel();\n    }\n\n    @Nonnull\n    private Label newLabel(@Nonnull int[] codeAddressToIndex, int codeAddress) {\n        MethodLocation referent = instructionList.get(mapCodeAddressToIndex(codeAddressToIndex, codeAddress));\n        return referent.addNewLabel();","sourceCodeStart":605,"sourceCodeEnd":641,"githubUrl":"https://github.com/Tencent/tinker/blob/1b7ea02c239840f563ea64fb5bd286eb98d4011e/tinker-build/tinker-patch-lib/src/main/java/org/jf/dexlib2/builder/BuilderMutableMethodImplementation.java#L605-L641","documentation":"IndexOutOfBoundsException from BuilderMutableMethodImplementation.newLabelForAddress(int): the requested code address is negative or beyond the last instruction's code address in the method. Called when dexlib2 materializes labels for offset-based references (switch/branch targets) during dex-to-builder conversion.","triggerScenarios":"An instruction offset (e.g., a switch payload code offset from a DexBacked dex) computes a codeAddress outside [0, last codeAddress]; typical for malformed branch targets or desynchronized codeAddress-to-index maps after instruction rewrites.","commonSituations":"Corrupted or non-standard dex; patches applied to a different old dex than they were generated from; older Tinker versions encountering newer dex layouts.","solutions":["Ensure old dex at apply time exactly matches the one used at diff time (signature check)","Upgrade Tinker to a release with a newer bundled dexlib2","Rebuild the base apk without exotic obfuscation and regenerate the patch"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// if driving the builder API directly\nint lastAddr = impl.getInstructions().get(impl.getInstructions().size() - 1).getCodeAddress();\nif (codeAddress < 0 || codeAddress > lastAddr) throw new IllegalArgumentException(\"bad codeAddress \" + codeAddress);\nLabel l = impl.newLabelForAddress(codeAddress);","typeGuard":null,"tryCatchPattern":"try { impl.newLabelForAddress(addr); } catch (IndexOutOfBoundsException e) { /* reject input dex */ }","preventionTips":["Bounds-check any externally derived offset before passing it into builder APIs","Keep generator and applier Tinker versions identical"],"tags":["dexlib2","dex","out-of-bounds","code-address","validation"],"backgroundTag":null,"analyzedSha":"1b7ea02c239840f563ea64fb5bd286eb98d4011e","analyzedAt":"2026-08-14T15:16:52.110Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}