Fix Dart_GetClassInfo

runtime/platform/json.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "platform/json.h"
 
 #include "platform/assert.h"
 #include "platform/globals.h"
 #include "platform/utils.h"
 #include "vm/os.h"
@@ skipping 344 matching lines @@
 }
 
 
 void TextBuffer::AddUTF8(uint32_t ch) {
   static const uint32_t kMaxOneByteChar   = 0x7F;
   static const uint32_t kMaxTwoByteChar   = 0x7FF;
   static const uint32_t kMaxThreeByteChar = 0xFFFF;
   static const uint32_t kMaxFourByteChar  = 0x10FFFF;
   static const uint32_t kMask = ~(1 << 6);
 
-  EnsureCapacity(sizeof(ch));
   if (ch <= kMaxOneByteChar) {
     EnsureCapacity(1);
     buf_[msg_len_++] = ch;
     buf_[msg_len_] = '\0';
     return;
   }
   if (ch <= kMaxTwoByteChar) {
     EnsureCapacity(2);
     buf_[msg_len_++] = 0xC0 | (ch >> 6);
     buf_[msg_len_++] = 0x80 | (ch & kMask);
@@ skipping 79 matching lines @@
         AddUTF8(cp);
       }
   }
 }
 
 
 void TextBuffer::EnsureCapacity(intptr_t len) {
   intptr_t remaining = buf_size_ - msg_len_;
   if (remaining <= len) {
     const int kBufferSpareCapacity = 64;  // Somewhat arbitrary.
+    // TODO(turnidge): do we need to guard against overflow or other
+    // security issues here? Text buffers are used by the debugger
+    // to send user-controlled data (e.g. values of string variables) to
+    // the debugger front-end.
     intptr_t new_size = buf_size_ + len + kBufferSpareCapacity;
     char* new_buf = reinterpret_cast<char*>(realloc(buf_, new_size));
     ASSERT(new_buf != NULL);
     buf_ = new_buf;
     buf_size_ = new_size;
   }
 }
 
 }  // namespace dart