Guard against integer overflow in process constructor.

runtime/bin/process.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "bin/dartutils.h"
 #include "bin/process.h"
 
 #include "include/dart_api.h"
 
 // Extract an array of C strings from a list of Dart strings.
 static char** ExtractCStringList(Dart_Handle strings,
                                  Dart_Handle status_handle,
                                  const char* error_msg,
                                  intptr_t* length) {
+  static const intptr_t kMaxArgumentListLength = 1024 * 1024;
   ASSERT(Dart_IsList(strings));
   intptr_t len = 0;
   Dart_Handle result = Dart_ListLength(strings, &len);
   if (Dart_IsError(result)) {
     Dart_PropagateError(result);
   }
+  // Protect against user-defined list implementations that can have
+  // arbitrary length.
+  if (len < 0 || len > kMaxArgumentListLength) {
+    DartUtils::SetIntegerField(status_handle, "_errorCode", 0);
+    DartUtils::SetStringField(
+        status_handle, "_errorMessage", "Max argument list length exceeded");
+    return NULL;
+  }
   *length = len;
   char** string_args = new char*[len];
   for (int i = 0; i < len; i++) {
     Dart_Handle arg = Dart_ListGetAt(strings, i);
     if (Dart_IsError(arg)) {
       delete[] string_args;
       Dart_PropagateError(arg);
     }
     if (!Dart_IsString(arg)) {
       DartUtils::SetIntegerField(status_handle, "_errorCode", 0);
@@ skipping 114 matching lines @@
 
 
 void FUNCTION_NAME(Process_Kill)(Dart_NativeArguments args) {
   Dart_EnterScope();
   intptr_t pid = DartUtils::GetIntegerValue(Dart_GetNativeArgument(args, 1));
   int signal = DartUtils::GetIntegerValue(Dart_GetNativeArgument(args, 2));
   bool success = Process::Kill(pid, signal);
   Dart_SetReturnValue(args, Dart_NewBoolean(success));
   Dart_ExitScope();
 }