[wasm] The interpreter should not grow memory beyond module->mem_max_pages.

src/wasm/wasm-interpreter.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/wasm/wasm-interpreter.h"
 
 #include "src/utils.h"
 #include "src/wasm/decoder.h"
 #include "src/wasm/function-body-decoder.h"
 #include "src/wasm/wasm-external-refs.h"
@@ skipping 646 matching lines @@
 }
 
 static inline int64_t ExecuteI64ReinterpretF64(double a, TrapReason* trap) {
   return bit_cast<int64_t>(a);
 }
 
 static inline int32_t ExecuteGrowMemory(uint32_t delta_pages,
                                         WasmInstance* instance) {
   // TODO(ahaas): Move memory allocation to wasm-module.cc for better
   // encapsulation.
-  if (delta_pages > wasm::kV8MaxWasmMemoryPages) {
+  if (delta_pages > wasm::kV8MaxWasmMemoryPages ||
+      delta_pages > instance->module->max_mem_pages) {
     return -1;
   }
   uint32_t old_size = instance->mem_size;
   uint32_t new_size;
   byte* new_mem_start;
   if (instance->mem_size == 0) {
     // TODO(gdeepti): Fix bounds check to take into account size of memtype.
     new_size = delta_pages * wasm::WasmModule::kPageSize;
     new_mem_start = static_cast<byte*>(calloc(new_size, sizeof(byte)));
     if (!new_mem_start) {
       return -1;
     }
   } else {
     DCHECK_NOT_NULL(instance->mem_start);
     new_size = old_size + delta_pages * wasm::WasmModule::kPageSize;
-    if (new_size > wasm::kV8MaxWasmMemoryPages * wasm::WasmModule::kPageSize) {
+    if (new_size / wasm::WasmModule::kPageSize > wasm::kV8MaxWasmMemoryPages ||
+        new_size / wasm::WasmModule::kPageSize >
+            instance->module->max_mem_pages) {
       return -1;
     }
     new_mem_start = static_cast<byte*>(realloc(instance->mem_start, new_size));
     if (!new_mem_start) {
       return -1;
     }
     // Zero initializing uninitialized memory from realloc
     memset(new_mem_start + old_size, 0, new_size - old_size);
   }
   instance->mem_start = new_mem_start;
@@ skipping 1188 matching lines @@
 
 ControlTransferMap WasmInterpreter::ComputeControlTransfersForTesting(
     Zone* zone, const byte* start, const byte* end) {
   ControlTransfers targets(zone, nullptr, start, end);
   return targets.map_;
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8