Check array bounds using an overflow-safe comparison.

runtime/vm/dart_api_impl.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "include/dart_api.h"
 
 #include "vm/bigint_operations.h"
 #include "vm/class_finalizer.h"
 #include "vm/compiler.h"
 #include "vm/dart.h"
@@ skipping 1549 matching lines @@
     byte_array ^= obj.raw();
     if (Utils::RangeCheck(offset, length, byte_array.Length())) {
       ByteArray::Copy(native_array, byte_array, offset, length);
       return Api::Success();
     }
     return Api::NewError("Invalid length passed in to access list elements");
   }
   if (obj.IsArray()) {
     Array& array_obj = Array::Handle();
     array_obj ^= obj.raw();
-    if ((offset + length) <= array_obj.Length()) {
+    if (Utils::RangeCheck(offset, length, array_obj.Length())) {
       Object& element = Object::Handle();
       Integer& integer  = Integer::Handle();
       for (int i = 0; i < length; i++) {
         element = array_obj.At(offset + i);
         if (!element.IsInteger()) {
           return Api::NewError("%s expects the argument 'list' to be "
                             "a List of int", CURRENT_FUNC);
         }
         integer ^= element.raw();
         native_array[i] = static_cast<uint8_t>(integer.AsInt64Value() & 0xff);
@@ skipping 58 matching lines @@
     }
     return Api::NewError("Invalid length passed in to set list elements");
   }
   if (obj.IsArray()) {
     if (obj.IsImmutableArray()) {
       return Api::NewError("Cannot modify immutable array");
     }
     Array& array_obj = Array::Handle();
     array_obj ^= obj.raw();
     Integer& integer = Integer::Handle();
-    if ((offset + length) <= array_obj.Length()) {
+    if (Utils::RangeCheck(offset, length, array_obj.Length())) {
       for (int i = 0; i < length; i++) {
         integer = Integer::New(native_array[i]);
         array_obj.SetAt(offset + i, integer);
       }
       return Api::Success();
     }
     return Api::NewError("Invalid length passed in to set array elements");
   }
   // TODO(5526318): Make access to GrowableObjectArray more efficient.
   // Now check and handle a dart object that implements the List interface.
@@ skipping 1052 matching lines @@
       *buffer = NULL;
     }
     delete debug_region;
   } else {
     *buffer = NULL;
     *buffer_size = 0;
   }
 }
 
 }  // namespace dart