Avoid trusting the length encoded in the Snapshot if there is an

runtime/vm/snapshot.h

Index: runtime/vm/snapshot.h
===================================================================
--- runtime/vm/snapshot.h	(revision 10993)
+++ runtime/vm/snapshot.h	(working copy)
@@ -111,8 +111,20 @@
   static const int kLengthIndex = 0;
   static const int kSnapshotFlagIndex = 1;
 
-  static const Snapshot* SetupFromBuffer(const void* raw_memory);
+  static const int kTrustedLength = -1;
 
+  // Convert a (buffer, buffer_len) to a Snapshot.
+  //
+  // This function will return NULL if buffer_len is less than the
+  // minimum legal size or if buffer_len does not match the length
+  // encoded internally in the buffer.
+  //
+  // If the buffer is coming from a trusted source, you can pass
+  // Snapshot::kTrustedLength to trust the length encoded internally
+  // in the buffer.
+  static const Snapshot* SetupFromBuffer(const void* buffer,
+                                         intptr_t buffer_len);
+
   // Getters.
   const uint8_t* content() const { return content_; }
   int32_t length() const { return length_; }
@@ -360,11 +372,12 @@
 
   // Finalize the serialized buffer by filling in the header information
   // which comprises of a flag(snaphot kind) and the length of
-  // serialzed bytes.
-  void FinalizeBuffer(Snapshot::Kind kind) {
+  // serialzed bytes.  Returns the total length of the buffer in bytes.
+  intptr_t FinalizeBuffer(Snapshot::Kind kind) {
     int32_t* data = reinterpret_cast<int32_t*>(stream_.buffer());
     data[Snapshot::kLengthIndex] = stream_.bytes_written();
     data[Snapshot::kSnapshotFlagIndex] = kind;
+    return stream_.bytes_written();
   }
 
  protected:
@@ -399,17 +412,18 @@
 
   // Finalize the serialized buffer by filling in the header information
   // which comprises of a flag(full/partial snaphot) and the length of
-  // serialzed bytes.
-  void FinalizeBuffer() {
-    BaseWriter::FinalizeBuffer(kind_);
+  // serialzed bytes.  Returns the total bytes written.
+  intptr_t FinalizeBuffer() {
+    intptr_t bytes_written = BaseWriter::FinalizeBuffer(kind_);
     UnmarkAll();
+    return bytes_written;
   }
 
   // Serialize an object into the buffer.
   void WriteObject(RawObject* raw);
 
   // Writes a full snapshot of the Isolate.
-  void WriteFullSnapshot();
+  intptr_t WriteFullSnapshot();
 
   uword GetObjectTags(RawObject* raw);
 
@@ -481,7 +495,7 @@
   ~ScriptSnapshotWriter() { }
 
   // Writes a partial snapshot of the script.
-  void WriteScriptSnapshot(const Library& lib);
+  intptr_t WriteScriptSnapshot(const Library& lib);
 
  private:
   DISALLOW_COPY_AND_ASSIGN(ScriptSnapshotWriter);