Enforce length/size limits for variable size heap object in order to

lib/string.cc

Index: lib/string.cc
===================================================================
--- lib/string.cc	(revision 9641)
+++ lib/string.cc	(working copy)
@@ -16,6 +16,21 @@
   Zone* zone = Isolate::Current()->current_zone();
   intptr_t len = a.Length();
 

[cshapiro, 2012/07/17 22:54:30]

The native argument is always a built-in Array.  We should make this a fatal
instead of a throw.

[turnidge, 2012/07/18 18:17:04]

Done.

+  // Currently the dart code copies all of the codepoints to another
+  // object array, so we are assured that the lengths will probably be
+  // sane since they are limited by the heap.
+  //
+  // Nonetheless, make sure that we enforce maximum element counts for
+  // strings, as the dart code may change.
+  if (len < 0 || len > FourByteString::kMaxElements) {
+    const String& error = String::Handle(String::NewFormatted(
+        "codePoints.length (%ld) must be in the range [0..%ld]",
+        len, Array::kMaxElements));
+    GrowableArray<const Object*> args;
+    args.Add(&error);
+    Exceptions::ThrowByType(Exceptions::kIllegalArgument, args);
+  }
+
   // Unbox the array and determine the maximum element width.
   bool is_one_byte_string = true;
   bool is_two_byte_string = true;