Enforce length/size limits for variable size heap object in order to

vm/dart_api_impl.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "include/dart_api.h"
 
 #include "vm/bigint_operations.h"
 #include "vm/class_finalizer.h"
 #include "vm/compiler.h"
 #include "vm/dart.h"
@@ skipping 48 matching lines @@
                            CURRENT_FUNC, #dart_handle, #type);                 \
     }                                                                          \
   } while (0)
 
 
 #define RETURN_NULL_ERROR(parameter)                                           \
   return Api::NewError("%s expects argument '%s' to be non-null.",             \
                        CURRENT_FUNC, #parameter);
 
 
+#define CHECK_LENGTH(length, max_elements)                                     \
+  do {                                                                         \
+    intptr_t len = (length);                                                   \
+    intptr_t max = (max_elements);                                             \
+    if (len < 0 || len > max) {                                                \
+      return Api::NewError(                                                    \
+          "%s expects argument '%s' to be in the range [0..%ld].",             \
+          CURRENT_FUNC, #length, max);                                         \
+    }                                                                          \
+  } while (0)
+
 // Takes a vm internal name and makes it suitable for external user.
 //
 // Examples:
 //
 // Internal getter and setter prefices are removed:
 //
 //   get:foo -> foo
 //   set:foo -> foo
 //
 // Private name mangling is removed, possibly twice:
@@ skipping 1494 matching lines @@
                          CURRENT_FUNC);
   }
   return Api::NewHandle(isolate, String::New(str));
 }
 
 
 DART_EXPORT Dart_Handle Dart_NewString8(const uint8_t* codepoints,
                                         intptr_t length) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
+  if (codepoints == NULL) {
+    RETURN_NULL_ERROR(codepoints);
+  }
+  CHECK_LENGTH(length, String::kMaxElements);
   return Api::NewHandle(isolate, String::New(codepoints, length));
 }
 
 
 DART_EXPORT Dart_Handle Dart_NewString16(const uint16_t* codepoints,
                                          intptr_t length) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
+  if (codepoints == NULL) {
+    RETURN_NULL_ERROR(codepoints);
+  }
+  CHECK_LENGTH(length, String::kMaxElements);
   return Api::NewHandle(isolate, String::New(codepoints, length));
 }
 
 
 DART_EXPORT Dart_Handle Dart_NewString32(const uint32_t* codepoints,
                                          intptr_t length) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
+  if (codepoints == NULL) {
+    RETURN_NULL_ERROR(codepoints);
+  }
+  CHECK_LENGTH(length, String::kMaxElements);
   return Api::NewHandle(isolate, String::New(codepoints, length));
 }
 
 
 DART_EXPORT bool Dart_IsExternalString(Dart_Handle object) {
   return RawObject::IsExternalStringClassId(Api::ClassId(object));
 }
 
 
 DART_EXPORT Dart_Handle Dart_ExternalStringGetPeer(Dart_Handle object,
@@ skipping 19 matching lines @@
 
 DART_EXPORT Dart_Handle Dart_NewExternalString8(const uint8_t* codepoints,
                                                 intptr_t length,
                                                 void* peer,
                                                 Dart_PeerFinalizer callback) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
   if (codepoints == NULL && length != 0) {
     RETURN_NULL_ERROR(codepoints);
   }
-  if (length < 0) {
-    return Api::NewError("%s expects argument 'length' to be greater than 0.",
-                         CURRENT_FUNC);
-  }
+  CHECK_LENGTH(length, String::kMaxElements);
   return Api::NewHandle(
       isolate, String::NewExternal(codepoints, length, peer, callback));
 }
 
 
 DART_EXPORT Dart_Handle Dart_NewExternalString16(const uint16_t* codepoints,
                                                  intptr_t length,
                                                  void* peer,
                                                  Dart_PeerFinalizer callback) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
   if (codepoints == NULL && length != 0) {
     RETURN_NULL_ERROR(codepoints);
   }
-  if (length < 0) {
-    return Api::NewError("%s expects argument 'length' to be greater than 0.",
-                         CURRENT_FUNC);
-  }
+  CHECK_LENGTH(length, String::kMaxElements);
   return Api::NewHandle(
       isolate, String::NewExternal(codepoints, length, peer, callback));
 }
 
 
 DART_EXPORT Dart_Handle Dart_NewExternalString32(const uint32_t* codepoints,
                                                  intptr_t length,
                                                  void* peer,
                                                  Dart_PeerFinalizer callback) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
   if (codepoints == NULL && length != 0) {
     RETURN_NULL_ERROR(codepoints);
   }
-  if (length < 0) {
-    return Api::NewError("%s expects argument 'length' to be greater than 0.",
-                         CURRENT_FUNC);
-  }
+  CHECK_LENGTH(length, String::kMaxElements);
   return Api::NewHandle(
       isolate, String::NewExternal(codepoints, length, peer, callback));
 }
 
 
 DART_EXPORT Dart_Handle Dart_StringGet8(Dart_Handle str,
                                         uint8_t* codepoints,
                                         intptr_t* length) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
@@ skipping 129 matching lines @@
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
   const Object& obj = Object::Handle(isolate, Api::UnwrapHandle(object));
   return GetListInstance(isolate, obj) != Instance::null();
 }
 
 
 DART_EXPORT Dart_Handle Dart_NewList(intptr_t length) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
+  CHECK_LENGTH(length, Array::kMaxElements);
   return Api::NewHandle(isolate, Array::New(length));
 }
 
 
 #define GET_LIST_LENGTH(isolate, type, obj, len)                               \
   type& array = type::Handle(isolate);                                         \
   array ^= obj.raw();                                                          \
   *len = array.Length();                                                       \
   return Api::Success(isolate);                                                \
 
@@ skipping 320 matching lines @@
 
 
 DART_EXPORT bool Dart_IsByteArray(Dart_Handle object) {
   return RawObject::IsByteArrayClassId(Api::ClassId(object));
 }
 
 
 DART_EXPORT Dart_Handle Dart_NewByteArray(intptr_t length) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
+  CHECK_LENGTH(length, Uint8Array::kMaxElements);
   return Api::NewHandle(isolate, Uint8Array::New(length));
 }
 
 
 DART_EXPORT Dart_Handle Dart_NewExternalByteArray(uint8_t* data,
                                                   intptr_t length,
                                                   void* peer,
                                                   Dart_PeerFinalizer callback) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
   if (data == NULL && length != 0) {
     RETURN_NULL_ERROR(data);
   }
-  if (length < 0) {
-    return Api::NewError("%s expects argument 'length' to be greater than 0.",
-                         CURRENT_FUNC);
-  }
+  CHECK_LENGTH(length, ExternalUint8Array::kMaxElements);
   return Api::NewHandle(
       isolate, ExternalUint8Array::New(data, length, peer, callback));
 }
 
 
 DART_EXPORT Dart_Handle Dart_ExternalByteArrayGetPeer(Dart_Handle object,
                                                       void** peer) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
   const ExternalUint8Array& array =
@@ skipping 1995 matching lines @@
 DART_EXPORT void Dart_InitPerfEventsSupport(Dart_FileWriterFunction function) {
   Dart::set_perf_events_writer(function);
 }
 
 
 DART_EXPORT void Dart_InitFlowGraphPrinting(Dart_FileWriterFunction function) {
   Dart::set_flow_graph_writer(function);
 }
 
 }  // namespace dart