Enforce length/size limits for variable size heap object in order to

lib/string.cc

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/bootstrap_natives.h"
 
 #include "vm/exceptions.h"
 #include "vm/native_entry.h"
 #include "vm/object.h"
 
 namespace dart {
 
 DEFINE_NATIVE_ENTRY(StringBase_createFromCodePoints, 1) {
   GET_NATIVE_ARGUMENT(Array, a, arguments->At(0));
   // TODO(srdjan): Check that parameterized type is an int.
   Zone* zone = Isolate::Current()->current_zone();
   intptr_t len = a.Length();
 

[cshapiro, 2012/07/17 22:54:30]

The native argument is always a built-in Array.  We should make this a fatal
instead of a throw.

[turnidge, 2012/07/18 18:17:04]

Done.

+  // Currently the dart code copies all of the codepoints to another
+  // object array, so we are assured that the lengths will probably be
+  // sane since they are limited by the heap.
+  //
+  // Nonetheless, make sure that we enforce maximum element counts for
+  // strings, as the dart code may change.
+  if (len < 0 || len > FourByteString::kMaxElements) {
+    const String& error = String::Handle(String::NewFormatted(
+        "codePoints.length (%ld) must be in the range [0..%ld]",
+        len, Array::kMaxElements));
+    GrowableArray<const Object*> args;
+    args.Add(&error);
+    Exceptions::ThrowByType(Exceptions::kIllegalArgument, args);
+  }
+
   // Unbox the array and determine the maximum element width.
   bool is_one_byte_string = true;
   bool is_two_byte_string = true;
   uint32_t* temp = reinterpret_cast<uint32_t*>(
       zone->Allocate(len * sizeof(uint32_t)));  // NOLINT
   Smi& element = Smi::Handle();
   for (intptr_t i = 0; i < len; i++) {
     const Object& index_object = Object::Handle(a.At(i));
     if (!index_object.IsSmi()) {
       GrowableArray<const Object*> args;
@@ skipping 119 matching lines @@
       GrowableArray<const Object*> args;
       args.Add(&elem);
       Exceptions::ThrowByType(Exceptions::kIllegalArgument, args);
     }
   }
   const String& result = String::Handle(String::ConcatAll(strings));
   arguments->SetReturn(result);
 }
 
 }  // namespace dart