Checks for valid CObject lengths in native API.

runtime/bin/dartutils.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "bin/dartutils.h"
 
 #include "include/dart_api.h"
 #include "include/dart_native_api.h"
 
 #include "platform/assert.h"
@@ skipping 900 matching lines @@
 }
 
 
 Dart_CObject* CObject::NewDouble(double value) {
   Dart_CObject* cobject = New(Dart_CObject_kDouble);
   cobject->value.as_double = value;
   return cobject;
 }
 
 
-Dart_CObject* CObject::NewString(int length) {
+Dart_CObject* CObject::NewString(intptr_t length) {
   Dart_CObject* cobject = New(Dart_CObject_kString, length + 1);
   cobject->value.as_string = reinterpret_cast<char*>(cobject + 1);
   return cobject;
 }
 
 
 Dart_CObject* CObject::NewString(const char* str) {
   int length = strlen(str);
   Dart_CObject* cobject = NewString(length);
   memmove(cobject->value.as_string, str, length + 1);
   return cobject;
 }
 
 
-Dart_CObject* CObject::NewArray(int length) {
+Dart_CObject* CObject::NewArray(intptr_t length) {
   Dart_CObject* cobject =
       New(Dart_CObject_kArray, length * sizeof(Dart_CObject*));  // NOLINT
   cobject->value.as_array.length = length;
   cobject->value.as_array.values =
       reinterpret_cast<Dart_CObject**>(cobject + 1);
   return cobject;
 }
 
 
-Dart_CObject* CObject::NewUint8Array(int length) {
+Dart_CObject* CObject::NewUint8Array(intptr_t length) {
   Dart_CObject* cobject = New(Dart_CObject_kTypedData, length);
   cobject->value.as_typed_data.type = Dart_TypedData_kUint8;
   cobject->value.as_typed_data.length = length;
   cobject->value.as_typed_data.values = reinterpret_cast<uint8_t*>(cobject + 1);
   return cobject;
 }
 
 
 Dart_CObject* CObject::NewExternalUint8Array(
-    int64_t length, uint8_t* data, void* peer,
+    intptr_t length, uint8_t* data, void* peer,
     Dart_WeakPersistentHandleFinalizer callback) {
   Dart_CObject* cobject = New(Dart_CObject_kExternalTypedData);
   cobject->value.as_external_typed_data.type = Dart_TypedData_kUint8;
   cobject->value.as_external_typed_data.length = length;
   cobject->value.as_external_typed_data.data = data;
   cobject->value.as_external_typed_data.peer = peer;
   cobject->value.as_external_typed_data.callback = callback;
   return cobject;
 }
 
 
 Dart_CObject* CObject::NewIOBuffer(int64_t length) {
+  // Make sure that we do not have an integer overflow here. Actual check
+  // against max elements will be done at the time of writing, as the constant
+  // is not part of the public API.
+  if (length > kIntptrMax) {
+    return NULL;
+  }
   uint8_t* data = IOBuffer::Allocate(length);
-  return NewExternalUint8Array(length, data, data, IOBuffer::Finalizer);
+  ASSERT(data != NULL);
+  return NewExternalUint8Array(
+      static_cast<intptr_t>(length), data, data, IOBuffer::Finalizer);
 }
 
 
 void CObject::FreeIOBufferData(Dart_CObject* cobject) {
   ASSERT(cobject->type == Dart_CObject_kExternalTypedData);
   cobject->value.as_external_typed_data.callback(
       NULL, cobject->value.as_external_typed_data.peer);
   cobject->value.as_external_typed_data.data = NULL;
 }
 
@@ skipping 22 matching lines @@
       new CObjectString(CObject::NewString(os_error->message()));
   CObjectArray* result = new CObjectArray(CObject::NewArray(3));
   result->SetAt(0, new CObjectInt32(CObject::NewInt32(kOSError)));
   result->SetAt(1, new CObjectInt32(CObject::NewInt32(os_error->code())));
   result->SetAt(2, error_message);
   return result;
 }
 
 }  // namespace bin
 }  // namespace dart