Harden builtins BuildResultFromMatchInfo and URIDecodeOctets

src/uri.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 "use strict";
 
 // This file relies on the fact that the following declaration has been made
 // in runtime.js:
 // var $Array = global.Array;
 
@@ skipping 66 matching lines @@
   var highCode = HexValueOf(highChar);
   var lowCode = HexValueOf(lowChar);
   if (highCode == -1 || lowCode == -1) {
     throw new $URIError("URI malformed");
   }
   return (highCode << 4) | lowCode;
 }
 
 
 function URIDecodeOctets(octets, result, index) {
+  if (!IS_STRING(result)) throw new $URIError("Internal error");
   var value;
   var o0 = octets[0];
   if (o0 < 0x80) {
     value = o0;
   } else if (o0 < 0xc2) {
     throw new $URIError("URI malformed");
   } else {
     var o1 = octets[1];
     if (o0 < 0xe0) {
       var a = o0 & 0x1f;
@@ skipping 44 matching lines @@
         } else {
           throw new $URIError("URI malformed");
         }
       }
     }
   }
   if (0xD800 <= value && value <= 0xDFFF) {
     throw new $URIError("URI malformed");
   }
   if (value < 0x10000) {
+    if (index < 0 || index >= result.length) {
+      throw new $URIError("Internal error");
+    }
     %_TwoByteSeqStringSetChar(result, index++, value);
     return index;
   } else {
+    if (index < 0 || index >= result.length - 1) {
+      throw new $URIError("Internal error");
+    }
     %_TwoByteSeqStringSetChar(result, index++, (value >> 10) + 0xd7c0);
     %_TwoByteSeqStringSetChar(result, index++, (value & 0x3ff) + 0xdc00);
     return index;
   }
 }
 
 
 // ECMA-262, section 15.1.3
 function Encode(uri, unescape) {
   var uriLength = uri.length;
@@ skipping 263 matching lines @@
     "escape", URIEscapeJS,
     "unescape", URIUnescapeJS,
     "decodeURI", URIDecode,
     "decodeURIComponent", URIDecodeComponent,
     "encodeURI", URIEncode,
     "encodeURIComponent", URIEncodeComponent
   ));
 }
 
 SetUpUri();