Fix IndexOutOfRangeException in ILVerify for invalid exception handler offsets

src/coreclr/tools/Common/TypeSystem/IL/ILImporter.cs

@@ -276,10 +276,23 @@ private void FindEHTargets()
             {
                 var r = _exceptionRegions[i];
 
-                CreateBasicBlock(r.ILRegion.TryOffset).TryStart = true;
+                if ((uint)r.ILRegion.TryOffset < (uint)_basicBlocks.Length)
+                    CreateBasicBlock(r.ILRegion.TryOffset).TryStart = true;
+                else
+                    ReportInvalidTryRegion();
+
                 if (r.ILRegion.Kind == ILExceptionRegionKind.Filter)
-                    CreateBasicBlock(r.ILRegion.FilterOffset).FilterStart = true;
-                CreateBasicBlock(r.ILRegion.HandlerOffset).HandlerStart = true;
+                {
+                    if ((uint)r.ILRegion.FilterOffset < (uint)_basicBlocks.Length)
+                        CreateBasicBlock(r.ILRegion.FilterOffset).FilterStart = true;
+                    else
+                        ReportInvalidFilterRegion();
+                }
+
+                if ((uint)r.ILRegion.HandlerOffset < (uint)_basicBlocks.Length)
+                    CreateBasicBlock(r.ILRegion.HandlerOffset).HandlerStart = true;
+                else
+                    ReportInvalidHandlerRegion();
             }
         }
 

src/coreclr/tools/ILVerification/ILImporter.Verify.cs

@@ -2823,6 +2823,21 @@ void ReportInvalidInstruction(ILOpcode opcode)
             VerificationError(VerifierError.UnknownOpcode);
         }
 
+        void ReportInvalidTryRegion()
+        {
+            VerificationError(VerifierError.TryRegionOutOfRange);
+        }
+
+        void ReportInvalidFilterRegion()
+        {
+            VerificationError(VerifierError.FilterRegionOutOfRange);
+        }
+
+        void ReportInvalidHandlerRegion()
+        {
+            VerificationError(VerifierError.HandlerRegionOutOfRange);
+        }
+
         //
         // Deprecated
         //

src/coreclr/tools/ILVerification/Strings.resx

@@ -297,6 +297,15 @@
   <data name="MethodFallthrough" xml:space="preserve">
     <value>Fall through end of the method without returning.</value>
   </data>
+  <data name="TryRegionOutOfRange" xml:space="preserve">
+    <value>try block exceeds code size.</value>
+  </data>
+  <data name="HandlerRegionOutOfRange" xml:space="preserve">
+    <value>handler block exceeds code size.</value>
+  </data>
+  <data name="FilterRegionOutOfRange" xml:space="preserve">
+    <value>filter block exceeds code size.</value>
+  </data>
   <data name="NewobjAbstractClass" xml:space="preserve">
     <value>Cannot construct an instance of abstract class.</value>
   </data>

src/coreclr/tools/ILVerification/VerifierError.cs

@@ -32,9 +32,9 @@ public enum VerifierError
 
         MethodFallthrough,              // Fall through end of the method without returning.
         //E_TRY_GTEQ_END                "try start >= try end."
-        //E_TRYEND_GT_CS                "try end > code size."
+        TryRegionOutOfRange,            // try end > code size.
         //E_HND_GTEQ_END                "handler start >= handler end."
-        //E_HNDEND_GT_CS                "handler end > code size."
+        HandlerRegionOutOfRange,        // handler end > code size.
         //E_TRY_START                   "Try starts in the middle of an instruction."
         //E_HND_START                   "Handler starts in the middle of an instruction."
         //E_TRY_OVERLAP                 "Try block overlap with another block."
@@ -44,7 +44,7 @@ public enum VerifierError
         //E_FIL_CONT_TRY                "Filter contains try."
         //E_FIL_CONT_HND                "Filter contains handler."
         //E_FIL_CONT_FIL                "Nested filters."
-        //E_FIL_GTEQ_CS                 "filter >= code size."
+        FilterRegionOutOfRange,         // filter >= code size.
         FallthroughException,           // Fallthrough the end of an exception block.
         FallthroughIntoHandler,         // Fallthrough into an exception handler.
         FallthroughIntoFilter,          // Fallthrough into an exception filter.

src/coreclr/tools/aot/ILCompiler.Compiler/IL/ILImporter.Scanner.cs

@@ -1600,6 +1600,21 @@ private static void ReportInvalidInstruction(ILOpcode opcode)
             ThrowHelper.ThrowInvalidProgramException();
         }
 
+        private static void ReportInvalidTryRegion()
+        {
+            ThrowHelper.ThrowInvalidProgramException();
+        }
+
+        private static void ReportInvalidFilterRegion()
+        {
+            ThrowHelper.ThrowInvalidProgramException();
+        }
+
+        private static void ReportInvalidHandlerRegion()
+        {
+            ThrowHelper.ThrowInvalidProgramException();
+        }
+
         private static bool IsTypeGetTypeFromHandle(MethodDesc method)
         {
             if (method.IsIntrinsic && method.Name.SequenceEqual("GetTypeFromHandle"u8))