[wasm] Validate the length of strings before validating the string.

src/wasm/module-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/wasm/module-decoder.h"
 
 #include "src/base/functional.h"
 #include "src/base/platform/platform.h"
 #include "src/macro-assembler.h"
 #include "src/objects.h"
@@ skipping 567 matching lines @@
     if (offset > static_cast<uint32_t>(limit_ - start_)) {
       error(pc_ - sizeof(uint32_t), "offset out of bounds of module");
     }
     return offset;
   }
 
   // Reads a length-prefixed string, checking that it is within bounds. Returns
   // the offset of the string, and the length as an out parameter.
   uint32_t consume_string(uint32_t* length, bool validate_utf8) {
     *length = consume_u32v("string length");
+    // Check if the string does not exceed module boundaries.
+    if (pc_ + *length >= end_) {

[titzer, 2016/09/06 09:02:33]

This can wrap around. There should be sufficient checks in consume_bytes(). Is
there any way to move the consume_bytes() up above the tracing?

[ahaas, 2016/09/06 09:22:12]

Done.

+      error(pc_, "invalid string length");
+    }
     uint32_t offset = pc_offset();
     TRACE("  +%u  %-20s: (%u bytes)\n", offset, "string", *length);
-    if (validate_utf8 && !unibrow::Utf8::Validate(pc_, *length)) {
+    if (ok() && validate_utf8 && !unibrow::Utf8::Validate(pc_, *length)) {
       error(pc_, "no valid UTF-8 string");
     }
     consume_bytes(*length);
     return offset;
   }
 
   uint32_t consume_sig_index(WasmModule* module, FunctionSig** sig) {
     const byte* pos = pc_;
     uint32_t sig_index = consume_u32v("signature index");
     if (sig_index >= module->signatures.size()) {
@@ skipping 213 matching lines @@
     decoder.consume_bytes(size);
   }
   if (decoder.more()) decoder.error("unexpected additional bytes");
 
   return decoder.toResult(std::move(table));
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8