Fix issue 11214 avoid length overflow in String::ConcatAll

runtime/vm/object.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/object.h"
 
 #include "include/dart_api.h"
 #include "platform/assert.h"
 #include "vm/assembler.h"
 #include "vm/cpu.h"
@@ skipping 11695 matching lines @@
 
 RawString* String::ConcatAll(const Array& strings,
                              Heap::Space space) {
   ASSERT(!strings.IsNull());
   intptr_t result_len = 0;
   intptr_t strings_len = strings.Length();
   String& str = String::Handle();
   intptr_t char_size = kOneByteChar;
   for (intptr_t i = 0; i < strings_len; i++) {
     str ^= strings.At(i);
-    result_len += str.Length();
+    intptr_t str_len = str.Length();
+    if ((kMaxElements - result_len) < str_len) {
+      Isolate* isolate = Isolate::Current();
+      const Instance& exception =
+          Instance::Handle(isolate->object_store()->out_of_memory());
+      Exceptions::Throw(exception);
+      UNREACHABLE();
+    }
+    result_len += str_len;
     char_size = Utils::Maximum(char_size, str.CharSize());
   }
   if (char_size == kOneByteChar) {
     return OneByteString::ConcatAll(strings, result_len, space);
   }
   ASSERT(char_size == kTwoByteChar);
   return TwoByteString::ConcatAll(strings, result_len, space);
 }
 
 
@@ skipping 453 matching lines @@
                                            intptr_t len,
                                            Heap::Space space) {
   const String& result = String::Handle(OneByteString::New(len, space));
   String& str = String::Handle();
   intptr_t strings_len = strings.Length();
   intptr_t pos = 0;
   for (intptr_t i = 0; i < strings_len; i++) {
     str ^= strings.At(i);
     intptr_t str_len = str.Length();
     String::Copy(result, pos, str, 0, str_len);
+    ASSERT((kMaxElements - pos) >= str_len);
     pos += str_len;
   }
   return OneByteString::raw(result);
 }
 
 
 RawOneByteString* OneByteString::Transform(int32_t (*mapping)(int32_t ch),
                                            const String& str,
                                            Heap::Space space) {
   ASSERT(!str.IsNull());
@@ skipping 143 matching lines @@
                                            intptr_t len,
                                            Heap::Space space) {
   const String& result = String::Handle(TwoByteString::New(len, space));
   String& str = String::Handle();
   intptr_t strings_len = strings.Length();
   intptr_t pos = 0;
   for (intptr_t i = 0; i < strings_len; i++) {
     str ^= strings.At(i);
     intptr_t str_len = str.Length();
     String::Copy(result, pos, str, 0, str_len);
+    ASSERT((kMaxElements - pos) >= str_len);
     pos += str_len;
   }
   return TwoByteString::raw(result);
 }
 
 
 RawTwoByteString* TwoByteString::Transform(int32_t (*mapping)(int32_t ch),
                                            const String& str,
                                            Heap::Space space) {
   ASSERT(!str.IsNull());
@@ skipping 1039 matching lines @@
                                     space);
   return reinterpret_cast<RawWeakProperty*>(raw);
 }
 
 
 const char* WeakProperty::ToCString() const {
   return "_WeakProperty";
 }
 
 }  // namespace dart