unicode-decoder: fix out-of-band write in utf16

test/cctest/test-api.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 7400 matching lines @@
   Local<Value> s4 = global->Get(v8_str("sym4"));
   CHECK(SameSymbol(sym0, Handle<String>::Cast(s0)));
   CHECK(SameSymbol(sym0b, Handle<String>::Cast(s0b)));
   CHECK(SameSymbol(sym1, Handle<String>::Cast(s1)));
   CHECK(SameSymbol(sym2, Handle<String>::Cast(s2)));
   CHECK(SameSymbol(sym3, Handle<String>::Cast(s3)));
   CHECK(SameSymbol(sym4, Handle<String>::Cast(s4)));
 }
 
 
+THREADED_TEST(Utf16MissingTrailing) {
+  LocalContext context;
+  v8::HandleScope scope(context->GetIsolate());
+
+  // Make sure it will go past the buffer, so it will call `WriteUtf16Slow`
+  int size = 1024 * 64;
+  uint8_t* buffer = new uint8_t[size];
+  for (int i = 0; i < size; i += 4) {
+    buffer[i] = 0xf0;
+    buffer[i + 1] = 0x9d;
+    buffer[i + 2] = 0x80;
+    buffer[i + 3] = 0x9e;
+  }
+
+  // Now invoke the decoder without last 3 bytes
+  v8::Local<v8::String> str =
+      v8::String::NewFromUtf8(
+          context->GetIsolate(), reinterpret_cast<char*>(buffer),
+          v8::NewStringType::kNormal, size - 3).ToLocalChecked();
+  USE(str);
+  delete[] buffer;
+}
+
+
+THREADED_TEST(Utf16Trailing3Byte) {
+  LocalContext context;
+  v8::HandleScope scope(context->GetIsolate());
+
+  // Make sure it will go past the buffer, so it will call `WriteUtf16Slow`
+  int size = 1024 * 63;
+  uint8_t* buffer = new uint8_t[size];
+  for (int i = 0; i < size; i += 3) {
+    buffer[i] = 0xe2;
+    buffer[i + 1] = 0x80;
+    buffer[i + 2] = 0xa6;
+  }
+
+  // Now invoke the decoder without last 3 bytes
+  v8::Local<v8::String> str =
+      v8::String::NewFromUtf8(
+          context->GetIsolate(), reinterpret_cast<char*>(buffer),
+          v8::NewStringType::kNormal, size).ToLocalChecked();
+
+  v8::String::Value value(str);
+  CHECK_EQ(value.length(), size / 3);
+  CHECK_EQ((*value)[value.length() - 1], 0x2026);
+
+  delete[] buffer;
+}
+
+
 THREADED_TEST(ToArrayIndex) {
   LocalContext context;
   v8::Isolate* isolate = context->GetIsolate();
   v8::HandleScope scope(isolate);
 
   v8::Handle<String> str = v8_str("42");
   v8::Handle<v8::Uint32> index = str->ToArrayIndex();
   CHECK(!index.IsEmpty());
   CHECK_EQ(42.0, index->Uint32Value());
   str = v8_str("42asdf");
@@ skipping 14311 matching lines @@
   CHECK(set->Has(env.local(), set).FromJust());
 
   CHECK(set->Delete(env.local(), set).FromJust());
   CHECK_EQ(2U, set->Size());
   CHECK(!set->Has(env.local(), set).FromJust());
   CHECK(!set->Delete(env.local(), set).FromJust());
 
   set->Clear();
   CHECK_EQ(0U, set->Size());
 }