Enforce length/size limits for variable size heap object in order to

lib/string.cc

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/bootstrap_natives.h"
 
 #include "vm/exceptions.h"
 #include "vm/native_entry.h"
 #include "vm/object.h"
 
 namespace dart {
 
 DEFINE_NATIVE_ENTRY(StringBase_createFromCodePoints, 1) {
   GET_NATIVE_ARGUMENT(Array, a, arguments->At(0));
   // TODO(srdjan): Check that parameterized type is an int.
   Zone* zone = Isolate::Current()->current_zone();
   intptr_t len = a.Length();
 
   // Unbox the array and determine the maximum element width.
   bool is_one_byte_string = true;
   bool is_two_byte_string = true;
+
+  const intptr_t kMaxLen = kIntptrMax / sizeof(uint32_t);
+  if (len > kMaxLen) {
+    // This should never happen because the native argument type is an
+    // Array, which is our standard list implementation.  It should

[cshapiro, 2012/07/19 05:49:01]

This is further strengthened by the size of an array header is equal to the size
of a string header.  It is possible for that correspondence to change but but
can validate here with a compile time assert.

[turnidge, 2012/07/31 23:21:45]

Removed.  Fixed in a forthcoming CL that changes zone->Allocate...

+    // not be able to grow so large as to trigger this.
+    FATAL1("StringBase_createFromCodePoints saw unexpectedly large len=%ld",
+           len);
+  }
+
   uint32_t* temp = reinterpret_cast<uint32_t*>(
       zone->Allocate(len * sizeof(uint32_t)));  // NOLINT
   Smi& element = Smi::Handle();
   for (intptr_t i = 0; i < len; i++) {
     const Object& index_object = Object::Handle(a.At(i));
     if (!index_object.IsSmi()) {
       GrowableArray<const Object*> args;
       args.Add(&index_object);
       Exceptions::ThrowByType(Exceptions::kIllegalArgument, args);
     }
@@ skipping 116 matching lines @@
       GrowableArray<const Object*> args;
       args.Add(&elem);
       Exceptions::ThrowByType(Exceptions::kIllegalArgument, args);
     }
   }
   const String& result = String::Handle(String::ConcatAll(strings));
   arguments->SetReturn(result);
 }
 
 }  // namespace dart