Avoid trusting the length encoded in the Snapshot if there is an

runtime/vm/snapshot.cc

Index: runtime/vm/snapshot.cc
===================================================================
--- runtime/vm/snapshot.cc	(revision 10993)
+++ runtime/vm/snapshot.cc	(working copy)
@@ -107,10 +107,16 @@
 
 // TODO(5411462): Temporary setup of snapshot for testing purposes,
 // the actual creation of a snapshot maybe done differently.
-const Snapshot* Snapshot::SetupFromBuffer(const void* raw_memory) {
-  ASSERT(raw_memory != NULL);
+const Snapshot* Snapshot::SetupFromBuffer(const void* buffer,
+                                          intptr_t buffer_len) {
+  ASSERT(buffer != NULL);
   ASSERT(kHeaderSize == sizeof(Snapshot));
   ASSERT(kLengthIndex == length_offset());
+  if (buffer_len != Snapshot::kTrustedLength &&
+      buffer_len < kHeaderSize) {
+    // The buffer is too short to be a valid message.
+    return NULL;
+  }
   ASSERT((kSnapshotFlagIndex * sizeof(int32_t)) == kind_offset());
   ASSERT((kHeapObjectTag & kInlined));
   // No object can have kFreeBit and kMarkBit set simultaneously. If kFreeBit
@@ -119,7 +125,13 @@
   ASSERT(kObjectId ==
          ((1 << RawObject::kFreeBit) | (1 << RawObject::kMarkBit)));
   ASSERT((kObjectAlignmentMask & kObjectId) == kObjectId);
-  const Snapshot* snapshot = reinterpret_cast<const Snapshot*>(raw_memory);
+  const Snapshot* snapshot = reinterpret_cast<const Snapshot*>(buffer);
+  if (buffer_len != Snapshot::kTrustedLength &&
+      buffer_len != snapshot->length()) {
+    // There is a mismatch between the buffer length and the
+    // snapshot's internal length.
+    return NULL;
+  }
   return snapshot;
 }
 
@@ -837,7 +849,7 @@
 }
 
 
-void SnapshotWriter::WriteFullSnapshot() {
+intptr_t SnapshotWriter::WriteFullSnapshot() {
   ASSERT(kind_ == Snapshot::kFull);
   Isolate* isolate = Isolate::Current();
   ASSERT(isolate != NULL);
@@ -853,7 +865,7 @@
   WriteForwardedObjects();
 
   // Finalize the snapshot buffer.
-  FinalizeBuffer();
+  return FinalizeBuffer();
 }
 
 
@@ -1104,14 +1116,14 @@
 }
 
 
-void ScriptSnapshotWriter::WriteScriptSnapshot(const Library& lib) {
+intptr_t ScriptSnapshotWriter::WriteScriptSnapshot(const Library& lib) {
   ASSERT(kind() == Snapshot::kScript);
 
   // Write out the library object.
   WriteObject(lib.raw());
 
   // Finalize the snapshot buffer.
-  FinalizeBuffer();
+  return FinalizeBuffer();
 }