Avoid trusting the length encoded in the Snapshot if there is an

runtime/vm/native_message_handler.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/native_message_handler.h"
 
 #include "vm/dart_api_message.h"
 #include "vm/isolate.h"
 #include "vm/message.h"
 #include "vm/snapshot.h"
@@ skipping 28 matching lines @@
   ApiZone* zone = ApiNativeScope::Current()->zone();
   return zone->Realloc<uint8_t>(ptr, old_size, new_size);
 }
 
 
 bool NativeMessageHandler::HandleMessage(Message* message) {
   if (message->IsOOB()) {
     // We currently do not use OOB messages for native ports.
     UNREACHABLE();
   }
+
+  const Snapshot* snapshot = Snapshot::SetupFromBuffer(message->data(),
+                                                       message->len());
+  if (snapshot == NULL || !snapshot->IsMessageSnapshot()) {
+    if (message->IsLocal()) {
+      FATAL("NativeMessageHandler saw malformed message.  Exiting.");
+    }
+    delete message;
+    return true;
+  }
+
   // Enter a native scope for handling the message. This will create a
   // zone for allocating the objects for decoding the message.
   ApiNativeScope scope;
-
-  int32_t length = reinterpret_cast<int32_t*>(
-      message->data())[Snapshot::kLengthIndex];
-  ApiMessageReader reader(message->data() + Snapshot::kHeaderSize,
-                          length,
-                          zone_allocator);
+  ApiMessageReader reader(snapshot, zone_allocator);
   Dart_CObject* object = reader.ReadMessage();
   (*func())(message->dest_port(), message->reply_port(), object);
   delete message;
   return true;
 }
 
 }  // namespace dart