Add length checks to ApiMessageWriter.

runtime/vm/snapshot_test.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "include/dart_debugger_api.h"
 #include "platform/assert.h"
 #include "vm/bigint_operations.h"
 #include "vm/class_finalizer.h"
 #include "vm/dart_api_impl.h"
 #include "vm/dart_api_message.h"
@@ skipping 113 matching lines @@
   ApiMessageWriter writer(&buffer, &malloc_allocator);
   writer.WriteCMessage(root);
 
   ApiMessageReader api_reader(buffer, writer.BytesWritten(), &zone_allocator);
   Dart_CObject* new_root = api_reader.ReadMessage();
 
   // Check that the two messages are the same.
   CompareDartCObjects(root, new_root);
 }
 
+
+static void ExpectEncodeFail(Dart_CObject* root) {
+  uint8_t* buffer = NULL;
+  ApiMessageWriter writer(&buffer, &malloc_allocator);
+  const bool result = writer.WriteCMessage(root);
+  EXPECT_EQ(false, result);
+}
+
+
 TEST_CASE(SerializeNull) {
   StackZone zone(Isolate::Current());
 
   // Write snapshot with object content.
   uint8_t* buffer;
   MessageWriter writer(&buffer, &zone_allocator);
   const Object& null_object = Object::Handle();
   writer.WriteMessage(null_object);
   intptr_t buffer_len = writer.BytesWritten();
 
@@ skipping 429 matching lines @@
   EXPECT_EQ(kArrayLength, root->value.as_array.length);
   for (int i = 0; i < kArrayLength; i++) {
     Dart_CObject* element = root->value.as_array.values[i];
     EXPECT_EQ(Dart_CObject_kInt32, element->type);
     EXPECT_EQ(i, element->value.as_int32);
   }
   CheckEncodeDecodeMessage(root);
 }
 
 
+TEST_CASE(FailSerializeLargeArray) {
+  Dart_CObject root;
+  root.type = Dart_CObject_kArray;
+  root.value.as_array.length = Array::kMaxElements + 1;
+  root.value.as_array.values = NULL;
+  ExpectEncodeFail(&root);
+}
+
+
+TEST_CASE(FailSerializeLargeNestedArray) {
+  Dart_CObject parent;
+  Dart_CObject child;
+  Dart_CObject* values[1] = { &child };
+
+  parent.type = Dart_CObject_kArray;
+  parent.value.as_array.length = 1;
+  parent.value.as_array.values = values;
+  child.type = Dart_CObject_kArray;
+  child.value.as_array.length = Array::kMaxElements + 1;
+  ExpectEncodeFail(&parent);
+}
+
+
+TEST_CASE(FailSerializeLargeTypedDataInt8) {
+  Dart_CObject root;
+  root.type = Dart_CObject_kTypedData;
+  root.value.as_typed_data.type = Dart_TypedData_kInt8;
+  root.value.as_typed_data.length =
+      TypedData::MaxElements(kTypedDataInt8ArrayCid) + 1;
+  ExpectEncodeFail(&root);
+}
+
+
+TEST_CASE(FailSerializeLargeTypedDataUint8) {
+  Dart_CObject root;
+  root.type = Dart_CObject_kTypedData;
+  root.value.as_typed_data.type = Dart_TypedData_kUint8;
+  root.value.as_typed_data.length =
+      TypedData::MaxElements(kTypedDataUint8ArrayCid) + 1;
+  ExpectEncodeFail(&root);
+}
+
+
+TEST_CASE(FailSerializeLargeExternalTypedData) {
+  Dart_CObject root;
+  root.type = Dart_CObject_kExternalTypedData;
+  root.value.as_typed_data.length =
+      ExternalTypedData::MaxElements(kExternalTypedDataUint8ArrayCid) + 1;
+  ExpectEncodeFail(&root);
+}
+
+
 TEST_CASE(SerializeEmptyArray) {
   StackZone zone(Isolate::Current());
 
   // Write snapshot with object content.
   uint8_t* buffer;
   MessageWriter writer(&buffer, &zone_allocator);
   const int kArrayLength = 0;
   Array& array = Array::Handle(Array::New(kArrayLength));
   writer.WriteMessage(array);
   intptr_t buffer_len = writer.BytesWritten();
@@ skipping 2006 matching lines @@
   result = Dart_RunLoop();
   EXPECT(Dart_IsError(result));
   EXPECT(Dart_ErrorHasException(result));
   EXPECT_SUBSTRING("Exception: nulltruefalse123456æøå3.14[]100123456789\n",
                    Dart_GetError(result));
 
   Dart_ExitScope();
 }
 
 }  // namespace dart