From d8ef2ae701b638b6d8dfb0fe09ee7d8bddb593e0 Mon Sep 17 00:00:00 2001
From: "asiva@google.com" <asiva@google.com>
Date: Tue, 11 Jun 2013 23:07:57 +0000
Subject: [PATCH] Fix issue 11214 avoid length overflow in String::ConcatAll

R=hausner@google.com

Review URL: https://codereview.chromium.org//16783003

git-svn-id: https://dart.googlecode.com/svn/branches/bleeding_edge/dart@23886 260f80e4-7a28-3924-810f-c04153c831b5
---
 runtime/vm/object.cc                | 12 +++++++++++-
 tests/language/string_overflow.dart | 24 ++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 tests/language/string_overflow.dart

diff --git a/runtime/vm/object.cc b/runtime/vm/object.cc
index ced446083d5..c29dd4fe7a3 100644
--- a/runtime/vm/object.cc
+++ b/runtime/vm/object.cc
@@ -11709,7 +11709,15 @@ RawString* String::ConcatAll(const Array& strings,
   intptr_t char_size = kOneByteChar;
   for (intptr_t i = 0; i < strings_len; i++) {
     str ^= strings.At(i);
-    result_len += str.Length();
+    intptr_t str_len = str.Length();
+    if ((kMaxElements - result_len) < str_len) {
+      Isolate* isolate = Isolate::Current();
+      const Instance& exception =
+          Instance::Handle(isolate->object_store()->out_of_memory());
+      Exceptions::Throw(exception);
+      UNREACHABLE();
+    }
+    result_len += str_len;
     char_size = Utils::Maximum(char_size, str.CharSize());
   }
   if (char_size == kOneByteChar) {
@@ -12183,6 +12191,7 @@ RawOneByteString* OneByteString::ConcatAll(const Array& strings,
     str ^= strings.At(i);
     intptr_t str_len = str.Length();
     String::Copy(result, pos, str, 0, str_len);
+    ASSERT((kMaxElements - pos) >= str_len);
     pos += str_len;
   }
   return OneByteString::raw(result);
@@ -12346,6 +12355,7 @@ RawTwoByteString* TwoByteString::ConcatAll(const Array& strings,
     str ^= strings.At(i);
     intptr_t str_len = str.Length();
     String::Copy(result, pos, str, 0, str_len);
+    ASSERT((kMaxElements - pos) >= str_len);
     pos += str_len;
   }
   return TwoByteString::raw(result);
diff --git a/tests/language/string_overflow.dart b/tests/language/string_overflow.dart
new file mode 100644
index 00000000000..fd1f285d30d
--- /dev/null
+++ b/tests/language/string_overflow.dart
@@ -0,0 +1,24 @@
+// Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+// Test to ensure that the VM does not have an integer overflow issue
+// when concatenating strings.
+
+import "package:expect/expect.dart";
+
+main()
+{
+  String a = "a";
+  for( ; a.length < 256 * 1024 * 1024 ; )
+    a = a + a;
+
+  var exception_thrown = false;
+  try {
+    var concat = "$a$a$a$a$a$a$a$a";
+  } on OutOfMemoryError catch (exc) {
+    exception_thrown = true;
+  }
+  Expect.isTrue(exception_thrown);
+}
+