Guard against buffer overflow in the x64 disassembler.

runtime/vm/disassembler_x64.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/disassembler.h"
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_IA32.
 #if defined(TARGET_ARCH_X64)
 #include "platform/utils.h"
 #include "vm/allocation.h"
@@ skipping 409 matching lines @@
   // Byte size operand override.
   bool byte_size_operand_;
 
   DISALLOW_COPY_AND_ASSIGN(DisassemblerX64);
 };
 
 
 // Append the str to the output buffer.
 void DisassemblerX64::AppendToBuffer(const char* format, ...) {
   char* buf = buffer_ + buffer_pos_;
+  intptr_t available = buffer_size_ - buffer_pos_;
+  if (available <= 1) return;  // Space for '\0' terminator.

[Erik Corry, 2012/10/12 08:06:27]

Perhaps assert that the null char is there.

[Kevin Millikin (Google), 2012/10/12 08:12:04]

Done.

   va_list args;
   va_start(args, format);
-  int retval = OS::VSNPrint(buf, buffer_size_, format, args);
+  int length = OS::VSNPrint(buf, available, format, args);
   va_end(args);
-  buffer_pos_ += retval;
+  buffer_pos_ =
+      (length >= available) ? (buffer_size_ - 1) : (buffer_pos_ + length);
+  ASSERT(buffer_pos_ < buffer_size_);
 }
 
 
 int DisassemblerX64::PrintRightOperandHelper(
     uint8_t* modrmp,
     RegisterNameMapping direct_register_name) {
   int mod, regop, rm;
   get_modrm(*modrmp, &mod, &regop, &rm);
   RegisterNameMapping register_name = (mod == 3) ? direct_register_name :
       &DisassemblerX64::NameOfCPURegister;
@@ skipping 1349 matching lines @@
       case 0xF7:
         data += F6F7Instruction(data);
         break;
 
       default:
         UnimplementedInstruction();
         data += 1;
     }
   }  // !processed
 
-  if (buffer_pos_ < buffer_size_) {
-    buffer_[buffer_pos_] = '\0';
-  }
+  ASSERT(buffer_[buffer_pos_] == '\0');
 
   int instr_len = data - reinterpret_cast<uint8_t*>(pc);
   ASSERT(instr_len > 0);  // Ensure progress.
 
   return instr_len;
 }
 
 
 int Disassembler::DecodeInstruction(char* hex_buffer, intptr_t hex_size,
                                     char* human_buffer, intptr_t human_size,
@@ skipping 42 matching lines @@
                                   human_buffer,
                                   sizeof(human_buffer),
                                   pc);
     pc += instruction_length;
   }
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_X64