Index: runtime/vm/snapshot.cc |
=================================================================== |
--- runtime/vm/snapshot.cc (revision 38738) |
+++ runtime/vm/snapshot.cc (working copy) |
@@ -136,6 +136,12 @@ |
((1 << RawObject::kWatchedBit) | (1 << RawObject::kMarkBit))); |
ASSERT((kObjectAlignmentMask & kObjectId) == kObjectId); |
const Snapshot* snapshot = reinterpret_cast<const Snapshot*>(raw_memory); |
+ // If the raw length is negative or greater than what the local machine can |
+ // handle, then signal an error. |
+ int64_t snapshot_length = ReadUnaligned(&snapshot->unaligned_length_); |
+ if ((snapshot_length < 0) || (snapshot_length > kIntptrMax)) { |
+ return NULL; |
+ } |
return snapshot; |
} |