{"record":{"id":"8a79a8de13210203","repo":"Tencent/tinker","slug":"instruction-index-d-out-of-bounds","errorCode":null,"errorMessage":"instruction index %d out of bounds","messagePattern":"instruction index (.+?) out of bounds","errorType":"exception","errorClass":"IndexOutOfBoundsException","httpStatus":null,"severity":"critical","filePath":"tinker-build/tinker-patch-lib/src/main/java/org/jf/dexlib2/builder/BuilderMutableMethodImplementation.java","lineNumber":632,"sourceCode":"                index++;\n            } while (index < instructionList.size() && instructionList.get(index).codeAddress <= codeAddress);\n            return index - 1;\n        }\n    }\n\n    @Nonnull\n    public Label newLabelForAddress(int codeAddress) {\n        if (codeAddress < 0 || codeAddress > instructionList.get(instructionList.size() - 1).codeAddress) {\n            throw new IndexOutOfBoundsException(String.format(\"codeAddress %d out of bounds\", codeAddress));\n        }\n        MethodLocation referent = instructionList.get(mapCodeAddressToIndex(codeAddress));\n        return referent.addNewLabel();\n    }\n\n    @Nonnull\n    public Label newLabelForIndex(int instructionIndex) {\n        if (instructionIndex < 0 || instructionIndex >= instructionList.size()) {\n            throw new IndexOutOfBoundsException(String.format(\"instruction index %d out of bounds\", instructionIndex));\n        }\n        MethodLocation referent = instructionList.get(instructionIndex);\n        return referent.addNewLabel();\n    }\n\n    @Nonnull\n    private Label newLabel(@Nonnull int[] codeAddressToIndex, int codeAddress) {\n        MethodLocation referent = instructionList.get(mapCodeAddressToIndex(codeAddressToIndex, codeAddress));\n        return referent.addNewLabel();\n    }\n\n    private static class SwitchPayloadReferenceLabel extends Label {\n        @Nonnull\n        public MethodLocation switchLocation;\n    }\n\n    @Nonnull\n    public Label newSwitchPayloadReferenceLabel(@Nonnull MethodLocation switchLocation,","sourceCodeStart":614,"sourceCodeEnd":650,"githubUrl":"https://github.com/Tencent/tinker/blob/1b7ea02c239840f563ea64fb5bd286eb98d4011e/tinker-build/tinker-patch-lib/src/main/java/org/jf/dexlib2/builder/BuilderMutableMethodImplementation.java#L614-L650","documentation":"IndexOutOfBoundsException from BuilderMutableMethodImplementation.newLabelForIndex(int): the given instruction index is negative or >= instructionList.size(). It guards label creation by index instead of by code address, and fires on the same class of malformed-offset problems as newLabelForAddress.","triggerScenarios":"Calling newLabelForIndex with an index past the end of the method's instruction list, or dexlib2 internally computing such an index from a bogus offset during builder conversion.","commonSituations":"Malformed dex from obfuscators; tools passing raw indices into the builder without bounds checks; corrupted patch application.","solutions":["If calling the API directly, clamp/validate the index against the instruction list size first","Upgrade Tinker/dexlib2 for newer dex compatibility","Verify the input dex parses cleanly with standard tools (e.g., baksmali) before patching"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (instructionIndex < 0 || instructionIndex >= instructions.size()) {\n    throw new IllegalArgumentException(\"index out of range: \" + instructionIndex);\n}\nimpl.newLabelForIndex(instructionIndex);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never pass raw indices computed from offsets without validating against list size","Recompute indices after any instruction insertion/removal, since indices shift"],"tags":["dexlib2","dex","out-of-bounds","instruction-index","validation"],"backgroundTag":null,"analyzedSha":"1b7ea02c239840f563ea64fb5bd286eb98d4011e","analyzedAt":"2026-08-14T15:16:52.110Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}