From: dslomov@chromium.org <dslomov@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Thu, 14 Nov 2013 11:40:32 +0000 (+0000)
Subject: Reland "Harden NumberToSize against overflows."
X-Git-Tag: upstream/4.7.83~11753
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=aefa2a2161113105fb203dfedf376a91ca1dfb5b;p=platform%2Fupstream%2Fv8.git

Reland "Harden NumberToSize against overflows."

The callers to NumberToSize are supposed to validate the number, but
this adds a last line of defense.

TBR=jkummerow@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/61733021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17737 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---

diff --git a/src/v8conversions.h b/src/v8conversions.h
index 3a7b524..d3da9f8 100644
--- a/src/v8conversions.h
+++ b/src/v8conversions.h
@@ -60,10 +60,17 @@ inline size_t NumberToSize(Isolate* isolate,
                            Object* number) {
   SealHandleScope shs(isolate);
   if (number->IsSmi()) {
-    return Smi::cast(number)->value();
+    int value = Smi::cast(number)->value();
+    CHECK_GE(value, 0);
+    ASSERT(
+      static_cast<unsigned>(Smi::kMaxValue)
+        <= std::numeric_limits<size_t>::max());
+    return static_cast<size_t>(value);
   } else {
     ASSERT(number->IsHeapNumber());
     double value = HeapNumber::cast(number)->value();
+    CHECK(value >= 0 &&
+          value <= std::numeric_limits<size_t>::max());
     return static_cast<size_t>(value);
   }
 }