[wasm] Enforce module size limit early enough

src/wasm/wasm-js.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/api-natives.h"
 #include "src/api.h"
 #include "src/asmjs/asm-js.h"
 #include "src/asmjs/asm-typer.h"
 #include "src/asmjs/asm-wasm-builder.h"
 #include "src/assert-scope.h"
@@ skipping 106 matching lines @@
 }
 
 i::wasm::ModuleWireBytes GetFirstArgumentAsBytes(
     const v8::FunctionCallbackInfo<v8::Value>& args, ErrorThrower* thrower) {
   if (args.Length() < 1) {
     thrower->TypeError("Argument 0 must be a buffer source");
     return i::wasm::ModuleWireBytes(nullptr, nullptr);
   }
 
   const byte* start = nullptr;
-  const byte* end = nullptr;
+  size_t length = 0;
   v8::Local<v8::Value> source = args[0];
   if (source->IsArrayBuffer()) {
     // A raw array buffer was passed.
     Local<ArrayBuffer> buffer = Local<ArrayBuffer>::Cast(source);
     ArrayBuffer::Contents contents = buffer->GetContents();
 
     start = reinterpret_cast<const byte*>(contents.Data());
-    end = start + contents.ByteLength();
-
+    length = contents.ByteLength();
   } else if (source->IsTypedArray()) {
     // A TypedArray was passed.
     Local<TypedArray> array = Local<TypedArray>::Cast(source);
     Local<ArrayBuffer> buffer = array->Buffer();
 
     ArrayBuffer::Contents contents = buffer->GetContents();
 
     start =
         reinterpret_cast<const byte*>(contents.Data()) + array->ByteOffset();
-    end = start + array->ByteLength();
-
+    length = array->ByteLength();
   } else {
     thrower->TypeError("Argument 0 must be a buffer source");
   }
-  if (start == nullptr || end == start) {
+  DCHECK_IMPLIES(length, start != nullptr);
+  if (length == 0) {
     thrower->CompileError("BufferSource argument is empty");
   }
+  if (length > i::wasm::kV8MaxWasmModuleSize) {
+    thrower->RangeError("buffer source exceeds maximum size of %zu (is %zu)",
+                        i::wasm::kV8MaxWasmModuleSize, length);
+  }
+  if (thrower->error()) return i::wasm::ModuleWireBytes(nullptr, nullptr);
   // TODO(titzer): use the handle as well?
-  return i::wasm::ModuleWireBytes(start, end);
+  return i::wasm::ModuleWireBytes(start, start + length);
 }
 
 i::MaybeHandle<i::JSReceiver> GetSecondArgumentAsImports(
     const v8::FunctionCallbackInfo<v8::Value>& args, ErrorThrower* thrower) {
   if (args.Length() < 2) return {};
   if (args[1]->IsUndefined()) return {};
 
   if (!args[1]->IsObject()) {
     thrower->TypeError("Argument 1 must be an object");
     return {};
@@ skipping 746 matching lines @@
   i::Handle<i::Symbol> symbol(isolate->context()->wasm_memory_sym(), isolate);
   return HasBrand(value, symbol);
 }
 
 bool WasmJs::IsWasmTableObject(Isolate* isolate, Handle<Object> value) {
   i::Handle<i::Symbol> symbol(isolate->context()->wasm_table_sym(), isolate);
   return HasBrand(value, symbol);
 }
 }  // namespace internal
 }  // namespace v8