dart-lang/sdk
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

Fix issue 11214 avoid length overflow in String::ConcatAll

Browse Source 
R=hausner@google.com

Review URL: https://codereview.chromium.org//16783003

git-svn-id: https://dart.googlecode.com/svn/branches/bleeding_edge/dart@23886 260f80e4-7a28-3924-810f-c04153c831b5
This commit is contained in:
asiva@google.com
2013-06-11 23:07:57 +00:00
parent 09dab7ecf3
commit d8ef2ae701
2 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runtime/vm/object.cc
+11 -1
View File
@@ -11709,7 +11709,15 @@ RawString* String::ConcatAll(const Array& strings,
intptr_t char_size = kOneByteChar;
for (intptr_t i = 0; i < strings_len; i++) {
str ^= strings.At(i);
result_len += str.Length();
intptr_t str_len = str.Length();
if ((kMaxElements - result_len) < str_len) {
Isolate* isolate = Isolate::Current();
const Instance& exception =
Instance::Handle(isolate->object_store()->out_of_memory());
Exceptions::Throw(exception);
UNREACHABLE();
}
result_len += str_len;
char_size = Utils::Maximum(char_size, str.CharSize());
}
if (char_size == kOneByteChar) {
@@ -12183,6 +12191,7 @@ RawOneByteString* OneByteString::ConcatAll(const Array& strings,
str ^= strings.At(i);
intptr_t str_len = str.Length();
String::Copy(result, pos, str, 0, str_len);
ASSERT((kMaxElements - pos) >= str_len);
pos += str_len;
}
return OneByteString::raw(result);
@@ -12346,6 +12355,7 @@ RawTwoByteString* TwoByteString::ConcatAll(const Array& strings,
str ^= strings.At(i);
intptr_t str_len = str.Length();
String::Copy(result, pos, str, 0, str_len);
ASSERT((kMaxElements - pos) >= str_len);
pos += str_len;
}
return TwoByteString::raw(result);
tests/language/string_overflow.dart
+24
View File
@@ -0,0 +1,24 @@
// Copyright (c) 2013, the Dart project authors. Please see the AUTHORS file
// for details. All rights reserved. Use of this source code is governed by a
// BSD-style license that can be found in the LICENSE file.
// Test to ensure that the VM does not have an integer overflow issue
// when concatenating strings.
import "package:expect/expect.dart";
main()
{
String a = "a";
for( ; a.length < 256 * 1024 * 1024 ; )
a = a + a;
var exception_thrown = false;
try {
var concat = "$a$a$a$a$a$a$a$a";
} on OutOfMemoryError catch (exc) {
exception_thrown = true;
}
Expect.isTrue(exception_thrown);
}