[wasm] Enforce limits for maximums for many WebAssembly binary entities.

src/wasm/ast-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/signature.h"
 
 #include "src/bit-vector.h"
 #include "src/flags.h"
 #include "src/handles.h"
 #include "src/zone/zone-containers.h"
@@ skipping 572 matching lines @@
       local_type_vec_.reserve(sig_->parameter_count());
       for (size_t i = 0; i < sig_->parameter_count(); ++i) {
         local_type_vec_.push_back(sig_->GetParam(i));
       }
     }
     // Decode local declarations, if any.
     uint32_t entries = consume_u32v("local decls count");
     TRACE("local decls count: %u\n", entries);
     while (entries-- > 0 && pc_ < limit_) {
       uint32_t count = consume_u32v("local count");
-      if (count > kMaxNumWasmLocals) {
+      if ((count + local_type_vec_.size()) > kMaxNumWasmLocals) {
         error(pc_ - 1, "local count too large");
         return;
       }
       byte code = consume_u8("local type");
       LocalType type;
       switch (code) {
         case kLocalI32:
           type = kAstI32;
           break;
         case kLocalI64:
@@ skipping 1455 matching lines @@
 BitVector* AnalyzeLoopAssignmentForTesting(Zone* zone, size_t num_locals,
                                            const byte* start, const byte* end) {
   FunctionBody body = {nullptr, nullptr, nullptr, start, end};
   WasmFullDecoder decoder(zone, nullptr, body);
   return decoder.AnalyzeLoopAssignmentForTesting(start, num_locals);
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8