Fix operand list iterators being validated when appending new instructions

The iterators now store an offset into the operand storage, rather than
a pointer. Deferencing the iterator retrieves the value at that offset
from the IL function.

This issue existed prior to the operand list storage refactor, but
became easier to hit after that change. The separate operand list vector
is smaller and thus more likely to reallocate when a new instruction is
appended.

1 files changed, 13 insertions, 9 deletions

diff --git a/lowlevelilinstruction.cpp b/lowlevelilinstruction.cpp
index 33c556bd..ba26b82e 100644
--- a/lowlevelilinstruction.cpp
+++ b/lowlevelilinstruction.cpp
@@ -597,14 +597,18 @@ bool LowLevelILIntegerList::ListIterator::operator<(const ListIterator& a) const
 LowLevelILIntegerList::ListIterator& LowLevelILIntegerList::ListIterator::operator++()
 {
 	count--;
-	cur++;
+	offset++;
 	return *this;
 }
 
 
 uint64_t LowLevelILIntegerList::ListIterator::operator*()
 {
-	return *cur;
+#ifdef BINARYNINJACORE_LIBRARY
+	return function->GetOperand(offset);
+#else
+	return BNLowLevelILGetOperand(function->GetObject(), offset);
+#endif
 }
 
 
@@ -612,11 +616,7 @@ LowLevelILIntegerList::LowLevelILIntegerList(
     LowLevelILFunction* func, size_t offset, size_t count)
 {
 	m_start.function = func;
-#ifdef BINARYNINJACORE_LIBRARY
-	m_start.cur = func->GetOperandPointer(offset);
-#else
-	m_start.cur = BNLowLevelILGetOperandPointer(func->GetObject(), offset);
-#endif
+	m_start.offset = offset;
 	m_start.count = count;
 }
 
@@ -631,7 +631,7 @@ LowLevelILIntegerList::const_iterator LowLevelILIntegerList::end() const
 {
 	const_iterator result;
 	result.function = m_start.function;
-	result.cur = m_start.cur + m_start.count;
+	result.offset = m_start.offset + m_start.count;
 	result.count = 0;
 	return result;
 }
@@ -647,7 +647,11 @@ uint64_t LowLevelILIntegerList::operator[](size_t i) const
 {
 	if (i >= size())
 		throw LowLevelILInstructionAccessException();
-	return m_start.cur[i];
+#ifdef BINARYNINJACORE_LIBRARY
+	return m_start.function->GetOperand(m_start.offset + i);
+#else
+	return BNLowLevelILGetOperand(m_start.function->GetObject(), m_start.offset + i);
+#endif
 }