Enforce length/size limits for variable size heap object in order to

vm/dart_api_impl.cc

Index: vm/dart_api_impl.cc
===================================================================
--- vm/dart_api_impl.cc	(revision 9641)
+++ vm/dart_api_impl.cc	(working copy)
@@ -1579,6 +1579,14 @@
                                         intptr_t length) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
+  if (codepoints == NULL) {
+    RETURN_NULL_ERROR(codepoints);
+  }
+  if (length < 0 || length > OneByteString::kMaxElements) {
+    return Api::NewError(
+        "%s expects argument 'length' to be in the range [0..%ld].",
+        CURRENT_FUNC, OneByteString::kMaxElements);
+  }
   return Api::NewHandle(isolate, String::New(codepoints, length));
 }
 
@@ -1587,6 +1595,14 @@
                                          intptr_t length) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
+  if (codepoints == NULL) {
+    RETURN_NULL_ERROR(codepoints);
+  }
+  if (length < 0 || length > TwoByteString::kMaxElements) {
+    return Api::NewError(
+        "%s expects argument 'length' to be in the range [0..%ld].",
+        CURRENT_FUNC, TwoByteString::kMaxElements);
+  }
   return Api::NewHandle(isolate, String::New(codepoints, length));
 }
 
@@ -1595,6 +1611,14 @@
                                          intptr_t length) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
+  if (codepoints == NULL) {
+    RETURN_NULL_ERROR(codepoints);
+  }
+  if (length < 0 || length > FourByteString::kMaxElements) {
+    return Api::NewError(
+        "%s expects argument 'length' to be in the range [0..%ld].",
+        CURRENT_FUNC, FourByteString::kMaxElements);
+  }
   return Api::NewHandle(isolate, String::New(codepoints, length));
 }
 
@@ -1652,9 +1676,10 @@
   if (codepoints == NULL && length != 0) {
     RETURN_NULL_ERROR(codepoints);
   }
-  if (length < 0) {
-    return Api::NewError("%s expects argument 'length' to be greater than 0.",
-                         CURRENT_FUNC);
+  if (length < 0 || length > ExternalTwoByteString::kMaxElements) {
+    return Api::NewError(
+        "%s expects argument 'length' to be in the range [0..%ld].",
+        CURRENT_FUNC, ExternalTwoByteString::kMaxElements);
   }
   return Api::NewHandle(
       isolate, String::NewExternal(codepoints, length, peer, callback));
@@ -1670,9 +1695,10 @@
   if (codepoints == NULL && length != 0) {
     RETURN_NULL_ERROR(codepoints);
   }
-  if (length < 0) {
-    return Api::NewError("%s expects argument 'length' to be greater than 0.",
-                         CURRENT_FUNC);
+  if (length < 0 || length > ExternalFourByteString::kMaxElements) {
+    return Api::NewError(
+        "%s expects argument 'length' to be in the range [0..%ld].",
+        CURRENT_FUNC, ExternalFourByteString::kMaxElements);
   }
   return Api::NewHandle(
       isolate, String::NewExternal(codepoints, length, peer, callback));
@@ -1823,6 +1849,11 @@
 DART_EXPORT Dart_Handle Dart_NewList(intptr_t length) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
+  if (length < 0 || length > Array::kMaxElements) {
+    return Api::NewError(
+        "%s expects argument 'length' to be in the range [0..%ld].",
+        CURRENT_FUNC, Array::kMaxElements);
+  }
   return Api::NewHandle(isolate, Array::New(length));
 }