[wasm] The interpreter should not grow memory beyond module->mem_max_pages.

src/wasm/wasm-interpreter.cc

Index: src/wasm/wasm-interpreter.cc
diff --git a/src/wasm/wasm-interpreter.cc b/src/wasm/wasm-interpreter.cc
index 521f4348769378abe676b2a38049faa427ed53ca..91ed3072f413d55a3e5dee16b63a9df60ffeeaa3 100644
--- a/src/wasm/wasm-interpreter.cc
+++ b/src/wasm/wasm-interpreter.cc
@@ -664,7 +664,8 @@ static inline int32_t ExecuteGrowMemory(uint32_t delta_pages,
                                         WasmInstance* instance) {
   // TODO(ahaas): Move memory allocation to wasm-module.cc for better
   // encapsulation.
-  if (delta_pages > wasm::kV8MaxWasmMemoryPages) {
+  if (delta_pages > wasm::kV8MaxWasmMemoryPages ||
+      delta_pages > instance->module->max_mem_pages) {
     return -1;
   }
   uint32_t old_size = instance->mem_size;
@@ -680,7 +681,9 @@ static inline int32_t ExecuteGrowMemory(uint32_t delta_pages,
   } else {
     DCHECK_NOT_NULL(instance->mem_start);
     new_size = old_size + delta_pages * wasm::WasmModule::kPageSize;
-    if (new_size > wasm::kV8MaxWasmMemoryPages * wasm::WasmModule::kPageSize) {
+    if (new_size > wasm::kV8MaxWasmMemoryPages * wasm::WasmModule::kPageSize ||

[titzer, 2017/01/11 15:27:06]

Do you want to check both of these the same way (e.g. in page units)?

[ahaas, 2017/01/11 15:36:53]

Done.

+        new_size / wasm::WasmModule::kPageSize >
+            instance->module->max_mem_pages) {
       return -1;
     }
     new_mem_start = static_cast<byte*>(realloc(instance->mem_start, new_size));