Avoid trusting the length encoded in the Snapshot if there is an

runtime/vm/dart.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/dart.h"
 
 #include "vm/dart_api_state.h"
 #include "vm/flags.h"
 #include "vm/freelist.h"
 #include "vm/handles.h"
@@ skipping 123 matching lines @@
 
   if (snapshot_buffer == NULL) {
     const Error& error = Error::Handle(Object::Init(isolate));
     if (!error.IsNull()) {
       return error.raw();
     }
   } else {
     // Initialize from snapshot (this should replicate the functionality
     // of Object::Init(..) in a regular isolate creation path.
     Object::InitFromSnapshot(isolate);
-    const Snapshot* snapshot = Snapshot::SetupFromBuffer(snapshot_buffer);
+    const Snapshot* snapshot =
+        Snapshot::SetupFromBuffer(snapshot_buffer, Snapshot::kTrustedLength);
+    if (snapshot == NULL) {
+      const String& message = String::Handle(String::New(
+          "Unexpected error during snapshot parsing."));
+      return ApiError::New(message);
+    }
     if (FLAG_trace_isolates) {
       OS::Print("Size of isolate snapshot = %ld\n", snapshot->length());
     }
     SnapshotReader reader(snapshot, isolate);
     reader.ReadFullSnapshot();
     if (FLAG_trace_isolates) {
       isolate->heap()->PrintSizes();
     }
     if (FLAG_print_bootstrap) {
       PrintLibrarySources(isolate);
@@ skipping 16 matching lines @@
   isolate->Shutdown();
   delete isolate;
 
   Dart_IsolateShutdownCallback callback = Isolate::ShutdownCallback();
   if (callback != NULL) {
     (callback)(callback_data);
   }
 }
 
 }  // namespace dart