Enforce length/size limits for variable size heap object in order to

lib/string.cc

Index: lib/string.cc
===================================================================
--- lib/string.cc	(revision 9641)
+++ lib/string.cc	(working copy)
@@ -19,6 +19,16 @@
   // Unbox the array and determine the maximum element width.
   bool is_one_byte_string = true;
   bool is_two_byte_string = true;
+
+  const intptr_t kMaxLen = kIntptrMax / sizeof(uint32_t);
+  if (len > kMaxLen) {
+    // This should never happen because the native argument type is an
+    // Array, which is our standard list implementation.  It should

[cshapiro, 2012/07/19 05:49:01]

This is further strengthened by the size of an array header is equal to the size
of a string header.  It is possible for that correspondence to change but but
can validate here with a compile time assert.

[turnidge, 2012/07/31 23:21:45]

Removed.  Fixed in a forthcoming CL that changes zone->Allocate...

+    // not be able to grow so large as to trigger this.
+    FATAL1("StringBase_createFromCodePoints saw unexpectedly large len=%ld",
+           len);
+  }
+
   uint32_t* temp = reinterpret_cast<uint32_t*>(
       zone->Allocate(len * sizeof(uint32_t)));  // NOLINT
   Smi& element = Smi::Handle();