Guard against buffer overflow in the x64 disassembler.

runtime/vm/disassembler_x64.cc

Index: runtime/vm/disassembler_x64.cc
diff --git a/runtime/vm/disassembler_x64.cc b/runtime/vm/disassembler_x64.cc
index 5cac646df8862e751b42d07970abcf10ae6f6a16..67bb5edfc95ef9528092d36634b7609cfdfa2bbc 100644
--- a/runtime/vm/disassembler_x64.cc
+++ b/runtime/vm/disassembler_x64.cc
@@ -427,11 +427,15 @@ class DisassemblerX64 : public ValueObject {
 // Append the str to the output buffer.
 void DisassemblerX64::AppendToBuffer(const char* format, ...) {
   char* buf = buffer_ + buffer_pos_;
+  intptr_t available = buffer_size_ - buffer_pos_;
+  if (available <= 1) return;  // Space for '\0' terminator.

[Erik Corry, 2012/10/12 08:06:27]

Perhaps assert that the null char is there.

[Kevin Millikin (Google), 2012/10/12 08:12:04]

Done.

   va_list args;
   va_start(args, format);
-  int retval = OS::VSNPrint(buf, buffer_size_, format, args);
+  int length = OS::VSNPrint(buf, available, format, args);
   va_end(args);
-  buffer_pos_ += retval;
+  buffer_pos_ =
+      (length >= available) ? (buffer_size_ - 1) : (buffer_pos_ + length);
+  ASSERT(buffer_pos_ < buffer_size_);
 }
 
 
@@ -1801,9 +1805,7 @@ int DisassemblerX64::InstructionDecode(uword pc) {
     }
   }  // !processed
 
-  if (buffer_pos_ < buffer_size_) {
-    buffer_[buffer_pos_] = '\0';
-  }
+  ASSERT(buffer_[buffer_pos_] == '\0');
 
   int instr_len = data - reinterpret_cast<uint8_t*>(pc);
   ASSERT(instr_len > 0);  // Ensure progress.