[wasm] Validate the length of strings before validating the string.

[wasm] Validate the length of strings before validating the string.

BUG=chromium:644182
R=titzer@chromium.org
TEST=module-decoder-unittest.cc:ExportNameWithInvalidStringLength

Committed: https://crrev.com/1a5f8fa53665e7431124f6a9f4710d1bef8ae38b
Cr-Commit-Position: refs/heads/master@{#39199}

[ahaas, 2016-09-06 08:58:05]

The CQ bit was checked by ahaas@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-09-06 08:58:13]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[titzer, 2016-09-06 09:02:33]

https://codereview.chromium.org/2310023002/diff/1/src/wasm/module-decoder.cc
File src/wasm/module-decoder.cc (right):

https://codereview.chromium.org/2310023002/diff/1/src/wasm/module-decoder.cc#...
src/wasm/module-decoder.cc:589: if (pc_ + *length >= end_) {
This can wrap around. There should be sufficient checks in consume_bytes(). Is
there any way to move the consume_bytes() up above the tracing?

[commit-bot: I haz the power, 2016-09-06 09:13:19]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-09-06 09:13:20]

Dry run: Try jobs failed on following builders:
  v8_linux64_avx2_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_avx2_rel_ng/buil...)
  v8_linux64_avx2_rel_ng_triggered on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_avx2_rel_ng_trig...)
  v8_mac_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_mac_rel_ng/builds/8265)
  v8_mac_rel_ng_triggered on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_mac_rel_ng_triggered/bui...)

[ahaas, 2016-09-06 09:21:46]

The CQ bit was checked by ahaas@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-09-06 09:21:52]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[ahaas, 2016-09-06 09:22:13]

https://codereview.chromium.org/2310023002/diff/1/src/wasm/module-decoder.cc
File src/wasm/module-decoder.cc (right):

https://codereview.chromium.org/2310023002/diff/1/src/wasm/module-decoder.cc#...
src/wasm/module-decoder.cc:589: if (pc_ + *length >= end_) {
On 2016/09/06 at 09:02:33, titzer wrote:
> This can wrap around. There should be sufficient checks in consume_bytes(). Is
there any way to move the consume_bytes() up above the tracing?

Done.

[titzer, 2016-09-06 09:25:43]

lgtm

[commit-bot: I haz the power, 2016-09-06 09:47:16]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-09-06 09:47:17]

Dry run: This issue passed the CQ dry run.

[ahaas, 2016-09-06 09:47:48]

The CQ bit was checked by ahaas@chromium.org

[commit-bot: I haz the power, 2016-09-06 09:47:56]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-06 09:50:16]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-09-06 09:50:42]

Description was changed from

==========
[wasm] Validate the length of strings before validating the string.

BUG=chromium:644182
R=titzer@chromium.org
TEST=module-decoder-unittest.cc:ExportNameWithInvalidStringLength
==========

to

==========
[wasm] Validate the length of strings before validating the string.

BUG=chromium:644182
R=titzer@chromium.org
TEST=module-decoder-unittest.cc:ExportNameWithInvalidStringLength

Committed: https://crrev.com/1a5f8fa53665e7431124f6a9f4710d1bef8ae38b
Cr-Commit-Position: refs/heads/master@{#39199}
==========

[commit-bot: I haz the power, 2016-09-06 09:50:42]

Patchset 2 (id:??) landed as
https://crrev.com/1a5f8fa53665e7431124f6a9f4710d1bef8ae38b
Cr-Commit-Position: refs/heads/master@{#39199}