Static type vulnerabilities caused by array covariance

In a previous example of a Java bytecode checksum, we saw that the JVM would validate the. class file it loads to ensure type safety. In Java, however, there is a case where the bytecode checksum of the compiler and the JVM cannot be detected, and the error that is to be discovered when it is actually run is the type of static system vulnerability caused by the covariance of the array.

Or, like the previous post, use ASM to generate bytecode:

Java code

Import Java.io.FileOutputStream;
Import Org.objectweb.asm.ClassWriter;
Import Org.objectweb.asm.MethodVisitor;

Import Org.objectweb.asm.Opcodes; public class Testasm implements opcodes {public static void main (string[] args) throws Exception {Classwrite
        R cw = new Classwriter (0);
            Cw.visit (v1_5,//class format version acc_public,//class modifiers
            ' Testverification ',//class name fully qualified name NULL,//generic signature
        "Java/lang/object",//Super class fully qualified name new string[] {}//implemented interfaces
        
        );                    Methodvisitor mv = Cw.visitmethod (acc_public + acc_static,//access modifiers "main",                     Method Name "([ljava/lang/string;) V",//Description NULL,                   Generic signature NULL   exceptions);
        Mv.visitcode ();
        MV.VISITINSN (iconst_1);
        MV.VISITTYPEINSN (Anewarray, "java/lang/float");
        MV.VISITTYPEINSN (Checkcast, "[Ljava/lang/object;");
        MV.VISITVARINSN (ASTORE, 0);
        MV.VISITVARINSN (aload, 0);
        MV.VISITINSN (ICONST_0);
        MV.VISITLDCINSN ("a string");
        MV.VISITINSN (Aastore);
        MV.VISITVARINSN (aload, 0);
        MV.VISITINSN (ICONST_0);
        MV.VISITINSN (Aaload);
        MV.VISITMETHODINSN (invokevirtual, "Java/lang/object", "toString", "() V");
        MV.VISITINSN (return);
        MV.VISITMAXS (3, 1); Mv.visitend (); End Method Cw.visitend ();
        End Class byte[] Clz = Cw.tobytearray ();
        FileOutputStream out = new FileOutputStream ("Testverification.class");
        Out.write (CLZ);
    Out.close (); }
}