Fix array-out-of-bounds in TypedDataView::ElementSizeInBytes.

runtime/vm/object.h

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #ifndef VM_OBJECT_H_
 #define VM_OBJECT_H_
 
 #include "include/dart_api.h"
 #include "platform/assert.h"
 #include "platform/utils.h"
@@ skipping 6931 matching lines @@
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t lengthInBytes) {
     ASSERT(0 <= lengthInBytes && lengthInBytes <= kSmiMax);
     return RoundedAllocationSize(sizeof(RawTypedData) + lengthInBytes);
   }
 
   static intptr_t ElementSizeInBytes(intptr_t class_id) {
     ASSERT(RawObject::IsTypedDataClassId(class_id));
-    return element_size[ElementType(class_id)];
+    return element_size(ElementType(class_id));
   }
 
   static TypedDataElementType ElementType(intptr_t class_id) {
     ASSERT(RawObject::IsTypedDataClassId(class_id));
     return static_cast<TypedDataElementType>(
         class_id - kTypedDataInt8ArrayCid);
   }
 
   static intptr_t MaxElements(intptr_t class_id) {
     ASSERT(RawObject::IsTypedDataClassId(class_id));
@@ skipping 60 matching lines @@
   }
 
   static RawTypedData* EmptyUint32Array(Isolate* isolate);
 
  protected:
   void SetLength(intptr_t value) const {
     StoreSmi(&raw_ptr()->length_, Smi::New(value));
   }
 
  private:
-  static const intptr_t element_size[];
+  static intptr_t element_size(intptr_t index) {
+    ASSERT(0 <= index && index < kNumElementSizes);
+    intptr_t size = element_size_table[index]
+    ASSERT(size != 0);
+    return size;
+  }
+  static const intptr_t kNumElementSizes = 14;

[Ivan Posva, 2015/02/25 23:52:44]

Where does 14 come from?

[koda, 2015/02/25 23:57:59]

That's the number of elements in the array; see object.cc. Cannot use ARRAY_SIZE
here since the definition is not available, and we want this to be inlined. Do
you prefer I make a (redundant) enum instead?

[Ivan Posva, 2015/02/26 00:15:44]

Isn't it "(kTypedDataFloat64x2ArrayCid - kTypedDataInt8ArrayCid) + 1" or
something similar?

[koda, 2015/02/27 18:21:57]

Done.

Sure. Until we add another type :) In any case of size mismatch, either the
compiler will complain about too few entries, or the assert will fire on a zero
entry.

+  static const intptr_t element_size_table[kNumElementSizes];
 
   FINAL_HEAP_OBJECT_IMPLEMENTATION(TypedData, Instance);
   friend class Class;
   friend class ExternalTypedData;
   friend class TypedDataView;
 };
 
 
 class ExternalTypedData : public Instance {
  public:
@@ skipping 56 matching lines @@
   static intptr_t data_offset() {
     return OFFSET_OF(RawExternalTypedData, data_);
   }
 
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalTypedData));
   }
 
   static intptr_t ElementSizeInBytes(intptr_t class_id) {
     ASSERT(RawObject::IsExternalTypedDataClassId(class_id));
-    return TypedData::element_size[ElementType(class_id)];
+    return TypedData::element_size(ElementType(class_id));
   }
 
   static TypedDataElementType ElementType(intptr_t class_id) {
     ASSERT(RawObject::IsExternalTypedDataClassId(class_id));
     return static_cast<TypedDataElementType>(
         class_id - kExternalTypedDataInt8ArrayCid);
   }
 
   static intptr_t MaxElements(intptr_t class_id) {
     ASSERT(RawObject::IsExternalTypedDataClassId(class_id));
@@ skipping 72 matching lines @@
     return kWordSize * kOffsetInBytesOffset;
   }
 
   static intptr_t length_offset() {
     return kWordSize * kLengthOffset;
   }
 
   static intptr_t ElementSizeInBytes(intptr_t class_id) {
     ASSERT(RawObject::IsTypedDataViewClassId(class_id));
     return (class_id == kByteDataViewCid) ?
-        TypedData::element_size[kTypedDataInt8ArrayCid] :
-        TypedData::element_size[class_id - kTypedDataInt8ArrayViewCid];
+        1 : TypedData::element_size(class_id - kTypedDataInt8ArrayViewCid);
   }
 
  private:
   enum {
     kDataOffset = 1,
     kOffsetInBytesOffset = 2,
     kLengthOffset = 3,
   };
 };
 
@@ skipping 591 matching lines @@
 
 
 RawObject* MegamorphicCache::GetTargetFunction(const Array& array,
                                                intptr_t index) {
   return array.At((index * kEntryLength) + kTargetFunctionIndex);
 }
 
 }  // namespace dart
 
 #endif  // VM_OBJECT_H_