Fix issue 11214 avoid length overflow in String::ConcatAll

runtime/vm/object.cc

Index: runtime/vm/object.cc
===================================================================
--- runtime/vm/object.cc	(revision 23830)
+++ runtime/vm/object.cc	(working copy)
@@ -11713,7 +11713,15 @@
   intptr_t char_size = kOneByteChar;
   for (intptr_t i = 0; i < strings_len; i++) {
     str ^= strings.At(i);
-    result_len += str.Length();
+    intptr_t str_len = str.Length();
+    if ((kMaxElements - result_len) < str_len) {
+      Isolate* isolate = Isolate::Current();
+      const Instance& exception =
+          Instance::Handle(isolate->object_store()->out_of_memory());
+      Exceptions::Throw(exception);
+      UNREACHABLE();
+    }
+    result_len += str_len;
     char_size = Utils::Maximum(char_size, str.CharSize());
   }
   if (char_size == kOneByteChar) {
@@ -12187,6 +12195,7 @@
     str ^= strings.At(i);
     intptr_t str_len = str.Length();
     String::Copy(result, pos, str, 0, str_len);
+    ASSERT((kMaxElements - pos) >= str_len);
     pos += str_len;
   }
   return OneByteString::raw(result);
@@ -12350,6 +12359,7 @@
     str ^= strings.At(i);
     intptr_t str_len = str.Length();
     String::Copy(result, pos, str, 0, str_len);
+    ASSERT((kMaxElements - pos) >= str_len);
     pos += str_len;
   }
   return TwoByteString::raw(result);