Error checking for length parameter of external array constructors in shell

src/d8.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 205 matching lines @@
     if (!ExecuteString(source, String::New(*file), false, false)) {
       return ThrowException(String::New("Error executing file"));
     }
   }
   return Undefined();
 }
 
 
 Handle<Value> Shell::CreateExternalArray(const Arguments& args,
                                          ExternalArrayType type,
-                                         int element_size) {
+                                         size_t element_size) {
   if (args.Length() != 1) {
     return ThrowException(
         String::New("Array constructor needs one parameter."));
   }
-  int length = args[0]->Int32Value();
-  void* data = malloc(length * element_size);
-  memset(data, 0, length * element_size);
+  if (args[0]->Int32Value() < 0) {
+    return ThrowException(String::New("Array length must not be negative."));
+  }
+  size_t length = static_cast<size_t>(args[0]->Int32Value());
+  if (length > static_cast<size_t>(internal::ExternalArray::kMaxLength)) {
+    return ThrowException(String::New("Array length exceeds maximum length."));
+  }
+  size_t malloc_size = length * element_size;
+  // Check for overflow in the multiplication.
+  if (malloc_size < length || malloc_size < element_size) {
+    return ThrowException(String::New("Array size exceeds memory limit."));
+  }
+  void* data = malloc(malloc_size);
+  if (data == NULL) {
+    return ThrowException(String::New("Memory allocation failed."));
+  }
+  memset(data, 0, malloc_size);
   Handle<Object> array = Object::New();
   Persistent<Object> persistent_array = Persistent<Object>::New(array);
   persistent_array.MakeWeak(data, ExternalArrayWeakCallback);
   persistent_array.MarkIndependent();
   array->SetIndexedPropertiesToExternalArrayData(data, type, length);
   array->Set(String::New("length"), Int32::New(length), ReadOnly);
   array->Set(String::New("BYTES_PER_ELEMENT"), Int32::New(element_size));
   return array;
 }
 
@@ skipping 736 matching lines @@
 }
 
 }  // namespace v8
 
 
 #ifndef GOOGLE3
 int main(int argc, char* argv[]) {
   return v8::Shell::Main(argc, argv);
 }
 #endif