Index: src/snapshot/code-serializer.cc |
diff --git a/src/snapshot/code-serializer.cc b/src/snapshot/code-serializer.cc |
index 7f57f0aa645bab4419a173ad13477789d894010f..1205991c9a4f6c9dd7dacb6e509227e621508b09 100644 |
--- a/src/snapshot/code-serializer.cc |
+++ b/src/snapshot/code-serializer.cc |
@@ -387,6 +387,9 @@ SerializedCodeData::SerializedCodeData(const List<byte>* payload, |
SetHeaderValue(kNumCodeStubKeysOffset, num_stub_keys); |
SetHeaderValue(kPayloadLengthOffset, payload->length()); |
+ // Zero out any padding in the header. |
+ memset(data_ + kUnalignedHeaderSize, 0, kHeaderSize - kUnalignedHeaderSize); |
+ |
// Copy reservation chunk sizes. |
CopyBytes(data_ + kHeaderSize, reinterpret_cast<byte*>(reservations.begin()), |
reservation_size); |
@@ -395,6 +398,7 @@ SerializedCodeData::SerializedCodeData(const List<byte>* payload, |
CopyBytes(data_ + kHeaderSize + reservation_size, |
reinterpret_cast<byte*>(stub_keys->begin()), stub_keys_size); |
+ // Zero out any padding before the payload. |
memset(data_ + payload_offset, 0, padded_payload_offset - payload_offset); |
// Copy serialized data. |
@@ -411,10 +415,14 @@ SerializedCodeData::SanityCheckResult SerializedCodeData::SanityCheck( |
if (this->size_ < kHeaderSize) return INVALID_HEADER; |
uint32_t magic_number = GetMagicNumber(); |
if (magic_number != ComputeMagicNumber(isolate)) return MAGIC_NUMBER_MISMATCH; |
+ if (GetExtraReferences() > GetExtraReferences(isolate)) { |
+ return MAGIC_NUMBER_MISMATCH; |
+ } |
uint32_t version_hash = GetHeaderValue(kVersionHashOffset); |
uint32_t source_hash = GetHeaderValue(kSourceHashOffset); |
uint32_t cpu_features = GetHeaderValue(kCpuFeaturesOffset); |
uint32_t flags_hash = GetHeaderValue(kFlagHashOffset); |
+ uint32_t payload_length = GetHeaderValue(kPayloadLengthOffset); |
uint32_t c1 = GetHeaderValue(kChecksum1Offset); |
uint32_t c2 = GetHeaderValue(kChecksum2Offset); |
if (version_hash != Version::Hash()) return VERSION_MISMATCH; |
@@ -423,6 +431,12 @@ SerializedCodeData::SanityCheckResult SerializedCodeData::SanityCheck( |
return CPU_FEATURES_MISMATCH; |
} |
if (flags_hash != FlagList::Hash()) return FLAGS_MISMATCH; |
+ uint32_t max_payload_length = |
+ this->size_ - |
+ POINTER_SIZE_ALIGN(kHeaderSize + |
+ GetHeaderValue(kNumReservationsOffset) * kInt32Size + |
+ GetHeaderValue(kNumCodeStubKeysOffset) * kInt32Size); |
+ if (payload_length > max_payload_length) return LENGTH_MISMATCH; |
if (!Checksum(DataWithoutHeader()).Check(c1, c2)) return CHECKSUM_MISMATCH; |
return CHECK_SUCCESS; |
} |