unicode-decoder: fix out-of-band write in utf16

unicode-decoder: fix out-of-band write in utf16

`WriteUtf16Slow` should not assume that the output buffer has enough
bytes to hold both words of surrogate pair. It should pass the number of
remaining bytes to the `Utf8::ValueOf` instead, just as we already do in
`Utf8DecoderBase::Reset`. Otherwise it will attempt to write the trail
uint16_t past the buffer boundary, leading to memory corruption and
possible crash.

Originally reported by: Kris Reeves <kris.re@bbhmedia.com>;

BUG=v8:4274
R=danno
R=svenpanne
LOG=y

Committed: https://crrev.com/b199bcdd47ae97ec116b430e34ab42001c8f04c0
Cr-Commit-Position: refs/heads/master@{#29485}

[fedor.indutny, 2015-07-02 19:42:47]

This is a security issue for node.js, io.js and maybe chromium!

[fedor.indutny, 2015-07-02 19:45:58]

Aaargh, didn't see the CC field. Looks like it is out for everyone now.

[fedor.indutny, 2015-07-03 19:16:37]

Just pushed out a follow up commit to fix handling of trailing 3 byte sequences.
I figured it is not possible to fix it without storing the number of bytes in
the unhandled stream.

Please let me know what you think, it is very critical for node.js/io.js

[jochen (gone - plz use gerrit), 2015-07-04 08:05:17]

jochen@chromium.org changed reviewers:
+ jochen@chromium.org

[jochen (gone - plz use gerrit), 2015-07-04 08:05:18]

https://codereview.chromium.org/1226493003/diff/40001/test/cctest/test-api.cc
File test/cctest/test-api.cc (right):

https://codereview.chromium.org/1226493003/diff/40001/test/cctest/test-api.cc...
test/cctest/test-api.cc:7436: v8::Handle<v8::String> str =
v8::String::NewFromUtf8(
please don't use deprecated APIs in tests.

Handle -> Local

https://codereview.chromium.org/1226493003/diff/40001/test/cctest/test-api.cc...
test/cctest/test-api.cc:7438: v8::String::kNormalString, size - 3);
v8::NewStringType::kNormal, size - 3).ToLocalChecked()

[fedor.indutny, 2015-07-04 17:02:39]

https://codereview.chromium.org/1226493003/diff/40001/test/cctest/test-api.cc
File test/cctest/test-api.cc (right):

https://codereview.chromium.org/1226493003/diff/40001/test/cctest/test-api.cc...
test/cctest/test-api.cc:7436: v8::Handle<v8::String> str =
v8::String::NewFromUtf8(
On 2015/07/04 08:05:18, jochen wrote:
> please don't use deprecated APIs in tests.
> 
> Handle -> Local

Fixed.

https://codereview.chromium.org/1226493003/diff/40001/test/cctest/test-api.cc...
test/cctest/test-api.cc:7438: v8::String::kNormalString, size - 3);
On 2015/07/04 08:05:18, jochen wrote:
> v8::NewStringType::kNormal, size - 3).ToLocalChecked()

Fixed, thank you!

[jochen (gone - plz use gerrit), 2015-07-06 07:30:02]

lgtm

[jochen (gone - plz use gerrit), 2015-07-06 10:30:15]

The CQ bit was checked by jochen@chromium.org

[commit-bot: I haz the power, 2015-07-06 10:30:20]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1226493003/60001

[Michael Hablich, 2015-07-06 10:30:26]

On 2015/07/06 07:30:02, jochen wrote:
> lgtm

I unprotected CL so it can be processed by CQ.

I also updated the description so that it references the bug.

[commit-bot: I haz the power, 2015-07-06 10:41:57]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-07-06 10:41:58]

Try jobs failed on following builders:
  v8_presubmit on tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_presubmit/builds/3975)

[jochen (gone - plz use gerrit), 2015-07-06 10:42:55]

The CQ bit was checked by jochen@chromium.org

[commit-bot: I haz the power, 2015-07-06 10:43:05]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1226493003/60001

[commit-bot: I haz the power, 2015-07-06 11:00:09]

Committed patchset #4 (id:60001)

[commit-bot: I haz the power, 2015-07-06 11:00:22]

Patchset 4 (id:??) landed as
https://crrev.com/b199bcdd47ae97ec116b430e34ab42001c8f04c0
Cr-Commit-Position: refs/heads/master@{#29485}

[fedor.indutny, 2015-07-06 16:40:16]

On 2015/07/06 11:00:22, commit-bot: I haz the power wrote:
> Patchset 4 (id:??) landed as
> https://crrev.com/b199bcdd47ae97ec116b430e34ab42001c8f04c0
> Cr-Commit-Position: refs/heads/master@{#29485}

Thank you!