Add length checks to ApiMessageWriter.

runtime/vm/dart_api_message.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
+#include "vm/bigint_operations.h"
 #include "vm/dart_api_message.h"
 #include "vm/object.h"
 #include "vm/snapshot_ids.h"
 #include "vm/symbols.h"
 #include "vm/unicode.h"
 
 namespace dart {
 
 static const int kNumInitialReferences = 4;
 
@@ skipping 865 matching lines @@
 
 bool ApiMessageWriter::WriteCObject(Dart_CObject* object) {
   if (IsCObjectMarked(object)) {
     intptr_t object_id = GetMarkedCObjectMark(object);
     WriteIndexedObject(kMaxPredefinedObjectIds + object_id);
     return true;
   }
 
   Dart_CObject_Type type = object->type;
   if (type == Dart_CObject_kArray) {
+    const intptr_t array_length = object->value.as_array.length;
+    if (array_length < 0 ||
+        array_length > Array::kMaxElements) {
+      return false;
+    }
+
     // Write out the serialization header value for this object.
     WriteInlinedHeader(object);
     // Write out the class and tags information.
     WriteIndexedObject(kArrayCid);
     WriteIntptrValue(0);
-
-    WriteSmi(object->value.as_array.length);
+    // Write out the length information.
+    WriteSmi(array_length);
     // Write out the type arguments.
     WriteNullObject();
     // Write out array elements.
-    for (int i = 0; i < object->value.as_array.length; i++) {
+    for (int i = 0; i < array_length; i++) {
       bool success = WriteCObjectRef(object->value.as_array.values[i]);
       if (!success) return false;
     }
     return true;
   }
   return WriteCObjectInlined(object, type);
 }
 
 
 bool ApiMessageWriter::WriteCObjectRef(Dart_CObject* object) {
   if (IsCObjectMarked(object)) {
     intptr_t object_id = GetMarkedCObjectMark(object);
     WriteIndexedObject(kMaxPredefinedObjectIds + object_id);
     return true;
   }
 
   Dart_CObject_Type type = object->type;
   if (type == Dart_CObject_kArray) {
+    const intptr_t array_length = object->value.as_array.length;
+    if (array_length < 0 ||
+        array_length > Array::kMaxElements) {
+      return false;
+    }
     // Write out the serialization header value for this object.
     WriteInlinedHeader(object);
     // Write out the class information.
     WriteIndexedObject(kArrayCid);
     // Write out the length information.
-    WriteSmi(object->value.as_array.length);
+    WriteSmi(array_length);
     // Add object to forward list so that this object is serialized later.
     AddToForwardList(object);
     return true;
   }
   return WriteCObjectInlined(object, type);
 }
 
 
 bool ApiMessageWriter::WriteForwardedCObject(Dart_CObject* object) {
   ASSERT(IsCObjectMarked(object));
   Dart_CObject_Type type =
       static_cast<Dart_CObject_Type>(object->type & kDartCObjectTypeMask);
   ASSERT(type == Dart_CObject_kArray);
+  const intptr_t array_length = object->value.as_array.length;
+  if (array_length < 0 ||
+      array_length > Array::kMaxElements) {
+    return false;
+  }
 
   // Write out the serialization header value for this object.
   intptr_t object_id = GetMarkedCObjectMark(object);
   WriteInlinedObjectHeader(kMaxPredefinedObjectIds + object_id);
   // Write out the class and tags information.
   WriteIndexedObject(kArrayCid);
   WriteIntptrValue(0);
-
-  WriteSmi(object->value.as_array.length);
+  // Write out the length information.
+  WriteSmi(array_length);
   // Write out the type arguments.
   WriteNullObject();
   // Write out array elements.
-  for (int i = 0; i < object->value.as_array.length; i++) {
+  for (int i = 0; i < array_length; i++) {
     bool success = WriteCObjectRef(object->value.as_array.values[i]);
     if (!success) return false;
   }
   return true;
 }
 
 
 bool ApiMessageWriter::WriteCObjectInlined(Dart_CObject* object,
                                            Dart_CObject_Type type) {
   switch (type) {
     case Dart_CObject_kNull:
       WriteNullObject();
       break;
     case Dart_CObject_kBool:
       if (object->value.as_bool) {
         WriteVMIsolateObject(kTrueValue);
       } else {
         WriteVMIsolateObject(kFalseValue);
       }
       break;
     case Dart_CObject_kInt32:
       WriteInt32(object);
       break;
     case Dart_CObject_kInt64:
       WriteInt64(object);
       break;
     case Dart_CObject_kBigint: {
+      char* hex_string = object->value.as_bigint;
+      const intptr_t chunk_len =
+          BigintOperations::ComputeChunkLength(hex_string);
+      if (chunk_len < 0 ||
+          chunk_len > Bigint::kMaxElements) {
+        return false;
+      }
       // Write out the serialization header value for this object.
       WriteInlinedHeader(object);
       // Write out the class and tags information.
       WriteIndexedObject(kBigintCid);
       WriteIntptrValue(0);
       // Write hex string length and content
-      char* hex_string = object->value.as_bigint;
       intptr_t len = strlen(hex_string);
       WriteIntptrValue(len);
       for (intptr_t i = 0; i < len; i++) {
         Write<uint8_t>(hex_string[i]);
       }
       break;
     }
     case Dart_CObject_kDouble:
       // Write out the serialization header value for this object.
       WriteInlinedHeader(object);
       // Write out the class and tags information.
       WriteIndexedObject(kDoubleCid);
       WriteIntptrValue(0);
       // Write double value.
       Write<double>(object->value.as_double);
       break;
     case Dart_CObject_kString: {
       const uint8_t* utf8_str =
           reinterpret_cast<const uint8_t*>(object->value.as_string);
       intptr_t utf8_len = strlen(object->value.as_string);
       if (!Utf8::IsValid(utf8_str, utf8_len)) {
         return false;
       }
 
       Utf8::Type type;
       intptr_t len = Utf8::CodeUnitCount(utf8_str, utf8_len, &type);
+      ASSERT(len > 0);
+      if (len > String::kMaxElements) {
+        return false;
+      }
 
       // Write out the serialization header value for this object.
       WriteInlinedHeader(object);
       // Write out the class and tags information.
       WriteIndexedObject(type == Utf8::kLatin1 ? kOneByteStringCid
                                                : kTwoByteStringCid);
       WriteIntptrValue(0);
       // Write string length, hash and content
       WriteSmi(len);
       WriteSmi(0);  // TODO(sgjesse): Hash - not written.
@@ skipping 31 matching lines @@
           class_id = kTypedDataInt8ArrayCid;
           break;
         case Dart_TypedData_kUint8:
           class_id = kTypedDataUint8ArrayCid;
           break;
         default:
           class_id = kTypedDataUint8ArrayCid;
           UNIMPLEMENTED();
       }
 
+      intptr_t len = object->value.as_typed_data.length;
+      if (len < 0 ||
+          len > TypedData::MaxElements(class_id)) {
+        return false;
+      }
+
       WriteIndexedObject(class_id);
       WriteIntptrValue(RawObject::ClassIdTag::update(class_id, 0));
+      WriteSmi(len);
       uint8_t* bytes = object->value.as_typed_data.values;
-      intptr_t len = object->value.as_typed_data.length;
-      WriteSmi(len);
       for (intptr_t i = 0; i < len; i++) {
         Write<uint8_t>(bytes[i]);
       }
       break;
     }
     case Dart_CObject_kExternalTypedData: {
       // TODO(ager): we are writing C pointers into the message in
       // order to post external arrays through ports. We need to make
       // sure that messages containing pointers can never be posted
       // to other processes.
 
       // Write out serialization header value for this object.
       WriteInlinedHeader(object);
       // Write out the class and tag information.
       WriteIndexedObject(kExternalTypedDataUint8ArrayCid);
       WriteIntptrValue(RawObject::ClassIdTag::update(
           kExternalTypedDataUint8ArrayCid, 0));
-      int length = object->value.as_external_typed_data.length;
+      intptr_t length = object->value.as_external_typed_data.length;
+      if (length < 0 ||
+          length > ExternalTypedData::MaxElements(
+              kExternalTypedDataUint8ArrayCid)) {
+        return false;
+      }
       uint8_t* data = object->value.as_external_typed_data.data;
       void* peer = object->value.as_external_typed_data.peer;
       Dart_WeakPersistentHandleFinalizer callback =
           object->value.as_external_typed_data.callback;
       WriteSmi(length);
       WriteIntptrValue(reinterpret_cast<intptr_t>(data));
       WriteIntptrValue(reinterpret_cast<intptr_t>(peer));
       WriteIntptrValue(reinterpret_cast<intptr_t>(callback));
       break;
     }
@@ skipping 19 matching lines @@
     if (!success) {
       UnmarkAllCObjects(object);
       return false;
     }
   }
   UnmarkAllCObjects(object);
   return true;
 }
 
 }  // namespace dart