java: fix java_class_parse (#4318)

librz/bin/format/java/class_bin.c

@@ -207,13 +207,15 @@ static bool java_class_parse(RzBinJavaClass *bin, ut64 base, Sdb *kv, RzBuffer *
 			goto java_class_parse_bad;
 		}
 		for (ut32 i = 0; i < bin->methods_count; ++i) {
+			if (is_eob(buf)) {
+				goto java_class_parse_bad;
+			}
 			offset = rz_buf_tell(buf) + base;
 			bin->methods[i] = java_method_new(bin->constant_pool,
 				bin->constant_pool_count, buf, offset, is_oak);
-		}
-		if (is_eob(buf)) {
-			rz_warn_if_reached();
-			goto java_class_parse_bad;
+			if (!bin->methods[i]) {
+				goto java_class_parse_bad;
+			}
 		}
 	}
 

librz/bin/format/java/class_method.c

@@ -58,19 +58,20 @@ Method *java_method_new(ConstPool **pool, ut32 poolsize, RzBuffer *buf, ut64 off
 	ut64 base = offset - rz_buf_tell(buf);
 
 	if (!java_method_new_aux(buf, method)) {
-		free(method);
-		return NULL;
+		goto err;
 	}
 
 	if (method->attributes_count < 1) {
 		return method;
 	}
+	if (method->attributes_count * 6 + rz_buf_tell(buf) >= rz_buf_size(buf)) {
+		goto err;
+	}
 
 	method->attributes = RZ_NEWS0(Attribute *, method->attributes_count);
 	if (!method->attributes) {
-		free(method);
 		rz_warn_if_reached();
-		return NULL;
+		goto err;
 	}
 
 	for (ut32 i = 0; i < method->attributes_count; ++i) {
@@ -84,6 +85,9 @@ Method *java_method_new(ConstPool **pool, ut32 poolsize, RzBuffer *buf, ut64 off
 		}
 	}
 	return method;
+err:
+	free(method);
+	return NULL;
 }
 
 void java_method_free(Method *method) {