[wasm] Validate the length of strings before validating the string.

src/wasm/module-decoder.cc

Index: src/wasm/module-decoder.cc
diff --git a/src/wasm/module-decoder.cc b/src/wasm/module-decoder.cc
index 09b52a45c5b32da638a3adbe0bf0d75869e700e2..cf855af21b2b6c7820d80e106be5bda2dfc2372e 100644
--- a/src/wasm/module-decoder.cc
+++ b/src/wasm/module-decoder.cc
@@ -587,10 +587,13 @@ class ModuleDecoder : public Decoder {
     *length = consume_u32v("string length");
     uint32_t offset = pc_offset();
     TRACE("  +%u  %-20s: (%u bytes)\n", offset, "string", *length);
-    if (validate_utf8 && !unibrow::Utf8::Validate(pc_, *length)) {
-      error(pc_, "no valid UTF-8 string");
-    }
+    const byte* string_start = pc_;
+    // Consume bytes before validation to guarantee that the string is not oob.
     consume_bytes(*length);
+    if (ok() && validate_utf8 &&
+        !unibrow::Utf8::Validate(string_start, *length)) {
+      error(string_start, "no valid UTF-8 string");
+    }
     return offset;
   }