Avoid trusting the length encoded in the Snapshot if there is an

runtime/vm/snapshot.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/snapshot.h"
 
 #include "platform/assert.h"
 #include "vm/bigint_operations.h"
 #include "vm/bootstrap.h"
 #include "vm/exceptions.h"
@@ skipping 89 matching lines @@
     return kListInterface;
   } else if (raw_type == object_store->byte_array_interface()) {
     return kByteArrayInterface;
   }
   return kInvalidIndex;
 }
 
 
 // TODO(5411462): Temporary setup of snapshot for testing purposes,
 // the actual creation of a snapshot maybe done differently.
-const Snapshot* Snapshot::SetupFromBuffer(const void* raw_memory) {
-  ASSERT(raw_memory != NULL);
+const Snapshot* Snapshot::SetupFromBuffer(const void* buffer,
+                                          intptr_t buffer_len) {
+  ASSERT(buffer != NULL);
   ASSERT(kHeaderSize == sizeof(Snapshot));
   ASSERT(kLengthIndex == length_offset());
+  if (buffer_len != Snapshot::kTrustedLength &&
+      buffer_len < kHeaderSize) {
+    // The buffer is too short to be a valid message.
+    return NULL;
+  }
   ASSERT((kSnapshotFlagIndex * sizeof(int32_t)) == kind_offset());
   ASSERT((kHeapObjectTag & kInlined));
   // No object can have kFreeBit and kMarkBit set simultaneously. If kFreeBit
   // is set then the rest of tags is a pointer to the next FreeListElement which
   // is kObjectAlignment aligned and has at least 2 lower bits set to zero.
   ASSERT(kObjectId ==
          ((1 << RawObject::kFreeBit) | (1 << RawObject::kMarkBit)));
   ASSERT((kObjectAlignmentMask & kObjectId) == kObjectId);
-  const Snapshot* snapshot = reinterpret_cast<const Snapshot*>(raw_memory);
+  const Snapshot* snapshot = reinterpret_cast<const Snapshot*>(buffer);
+  if (buffer_len != Snapshot::kTrustedLength &&
+      buffer_len != snapshot->length()) {
+    // There is a mismatch between the buffer length and the
+    // snapshot's internal length.
+    return NULL;
+  }
   return snapshot;
 }
 
 
 RawSmi* BaseReader::ReadAsSmi() {
   intptr_t value = ReadIntptrValue();
   ASSERT((value & kSmiTagMask) == 0);
   return reinterpret_cast<RawSmi*>(value);
 }
 
@@ skipping 697 matching lines @@
     }                                                                          \
 
     CLASS_LIST_NO_OBJECT(SNAPSHOT_WRITE)
 #undef SNAPSHOT_WRITE
     default: break;
   }
   UNREACHABLE();
 }
 
 
-void SnapshotWriter::WriteFullSnapshot() {
+intptr_t SnapshotWriter::WriteFullSnapshot() {
   ASSERT(kind_ == Snapshot::kFull);
   Isolate* isolate = Isolate::Current();
   ASSERT(isolate != NULL);
   ObjectStore* object_store = isolate->object_store();
   ASSERT(object_store != NULL);
 
   // Write out all the objects in the object store of the isolate which
   // is the root set for all dart allocated objects at this point.
   SnapshotWriterVisitor visitor(this, false);
   object_store->VisitObjectPointers(&visitor);
 
   // Write out all forwarded objects.
   WriteForwardedObjects();
 
   // Finalize the snapshot buffer.
-  FinalizeBuffer();
+  return FinalizeBuffer();
 }
 
 
 uword SnapshotWriter::GetObjectTags(RawObject* raw) {
   uword tags = raw->ptr()->tags_;
   if (SerializedHeaderTag::decode(tags) == kObjectId) {
     intptr_t id = SerializedHeaderData::decode(tags);
     return forward_list_[id - kMaxPredefinedObjectIds]->tags();
   } else {
     return tags;
@@ skipping 230 matching lines @@
   // Write out the type arguments.
   WriteObjectImpl(type_arguments);
 
   // Write out the individual object ids.
   for (intptr_t i = 0; i < len; i++) {
     WriteObjectRef(data[i]);
   }
 }
 
 
-void ScriptSnapshotWriter::WriteScriptSnapshot(const Library& lib) {
+intptr_t ScriptSnapshotWriter::WriteScriptSnapshot(const Library& lib) {
   ASSERT(kind() == Snapshot::kScript);
 
   // Write out the library object.
   WriteObject(lib.raw());
 
   // Finalize the snapshot buffer.
-  FinalizeBuffer();
+  return FinalizeBuffer();
 }
 
 
 void SnapshotWriterVisitor::VisitPointers(RawObject** first, RawObject** last) {
   for (RawObject** current = first; current <= last; current++) {
     RawObject* raw_obj = *current;
     if (as_references_) {
       writer_->WriteObjectRef(raw_obj);
     } else {
       writer_->WriteObjectImpl(raw_obj);
     }
   }
 }
 
 }  // namespace dart