Add checks catching potential integer overflows.

runtime/vm/object.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/object.h"
 
 #include "include/dart_api.h"
 #include "platform/assert.h"
 #include "vm/assembler.h"
 #include "vm/cpu.h"
@@ skipping 8104 matching lines @@
                            BitmapBuilder* bmap,
                            intptr_t register_bit_count) {
   ASSERT(Object::stackmap_class() != Class::null());
   ASSERT(bmap != NULL);
   Stackmap& result = Stackmap::Handle();
   // Guard against integer overflow of the instance size computation.
   intptr_t length = bmap->Length();
   intptr_t payload_size =
       Utils::RoundUp(length, kBitsPerByte) / kBitsPerByte;
   if ((payload_size < 0) ||
-      (payload_size >
-           (kSmiMax - static_cast<intptr_t>(sizeof(RawStackmap))))) {
+      (payload_size > kMaxLengthInBytes)) {
     // This should be caught before we reach here.
     FATAL1("Fatal error in Stackmap::New: invalid length %" Pd "\n",
            length);
   }
   {
     // Stackmap data objects are associated with a code object, allocate them
     // in old generation.
     RawObject* raw = Object::Allocate(Stackmap::kClassId,
                                       Stackmap::InstanceSize(length),
                                       Heap::kOld);
@@ skipping 403 matching lines @@
 
 
 void DeoptInfo::PrintToJSONStream(JSONStream* stream, bool ref) const {
   stream->OpenObject();
   stream->CloseObject();
 }
 
 
 RawDeoptInfo* DeoptInfo::New(intptr_t num_commands) {
   ASSERT(Object::deopt_info_class() != Class::null());
+  if ((num_commands < 0) || (num_commands > kMaxElements)) {
+    FATAL1("Fatal error in DeoptInfo::New(): invalid num_commands %" Pd "\n",
+           num_commands);
+  }
   DeoptInfo& result = DeoptInfo::Handle();
   {
     uword size = DeoptInfo::InstanceSize(num_commands);
     RawObject* raw = Object::Allocate(DeoptInfo::kClassId,
                                       size,
                                       Heap::kOld);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(num_commands);
   }
@@ skipping 5794 matching lines @@
   8,   // kTypedDataUint64ArrayCid.
   4,   // kTypedDataFloat32ArrayCid.
   8,   // kTypedDataFloat64ArrayCid.
   16,  // kTypedDataFloat32x4ArrayCid.
 };
 
 
 RawTypedData* TypedData::New(intptr_t class_id,
                              intptr_t len,
                              Heap::Space space) {
-  // TODO(asiva): Add a check for maximum elements.
+  if (len < 0 || len > TypedData::MaxElements(class_id)) {
+    FATAL1("Fatal error in TypedData::New: invalid len %" Pd "\n", len);
+  }
   TypedData& result = TypedData::Handle();
   {
-    // The len field has already been checked by the caller, we only assert
-    // here that it is within a valid range.
-    ASSERT((len >= 0) &&
-           (len < (kSmiMax / TypedData::ElementSizeInBytes(class_id))));
     intptr_t lengthInBytes = len * ElementSizeInBytes(class_id);
     RawObject* raw = Object::Allocate(class_id,
                                       TypedData::InstanceSize(lengthInBytes),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
     if (len > 0) {
       memset(result.DataAddr(0), 0, lengthInBytes);
     }
@@ skipping 507 matching lines @@
 }
 
 
 void MirrorReference::PrintToJSONStream(JSONStream* stream, bool ref) const {
   stream->OpenObject();
   stream->CloseObject();
 }
 
 
 }  // namespace dart