Enforce length/size limits for variable size heap object in order to

lib/array.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "platform/assert.h"
 #include "vm/bootstrap_natives.h"
 #include "vm/assembler.h"
 #include "vm/bigint_operations.h"
 #include "vm/exceptions.h"
 #include "vm/native_entry.h"
 #include "vm/object.h"
 
 namespace dart {
 
 DEFINE_NATIVE_ENTRY(ObjectArray_allocate, 2) {
   const AbstractTypeArguments& type_arguments =
       AbstractTypeArguments::CheckedHandle(arguments->At(0));
   ASSERT(type_arguments.IsNull() ||
          (type_arguments.IsInstantiated() && (type_arguments.Length() == 1)));
   GET_NATIVE_ARGUMENT(Smi, length, arguments->At(1));
-  if (length.Value() < 0) {
+  intptr_t len = length.Value();
+  if (len < 0 || len > Array::kMaxElements) {
+    const String& error = String::Handle(String::NewFormatted(
+        "length (%ld) must be in the range [0..%ld]",
+        len, Array::kMaxElements));
     GrowableArray<const Object*> args;
-    args.Add(&length);
+    args.Add(&error);
     Exceptions::ThrowByType(Exceptions::kIllegalArgument, args);
   }
   const Array& new_array = Array::Handle(Array::New(length.Value()));
   new_array.SetTypeArguments(type_arguments);
   arguments->SetReturn(new_array);
 }
 
 
 DEFINE_NATIVE_ENTRY(ObjectArray_getIndexed, 2) {
   const Array& array = Array::CheckedHandle(arguments->At(0));
@@ skipping 64 matching lines @@
     }
   } else {
     for (intptr_t i = 0; i < icount; i++) {
       src_obj = source.At(isrc_start + i);
       dest.SetAt(idst_start + i, src_obj);
     }
   }
 }
 
 }  // namespace dart