From 10138add5744b1c12ac6b6ae19da341a9e9051f7 Mon Sep 17 00:00:00 2001 From: "dslomov@chromium.org" Date: Thu, 14 Nov 2013 11:14:06 +0000 Subject: [PATCH] Harden NumberToSize against overflows. The callers to NumberToSize are supposed to validate the number, but this adds a last line of defense. R=jkummerow@chromium.org, ulan@chromium.org Review URL: https://codereview.chromium.org/72323003 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17733 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/v8conversions.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/v8conversions.h b/src/v8conversions.h index 3a7b5242ab..b1d96b4b8a 100644 --- a/src/v8conversions.h +++ b/src/v8conversions.h @@ -60,10 +60,15 @@ inline size_t NumberToSize(Isolate* isolate, Object* number) { SealHandleScope shs(isolate); if (number->IsSmi()) { - return Smi::cast(number)->value(); + int value = Smi::cast(number)->value(); + CHECK_GE(value, 0); + ASSERT(Smi::kMaxValue <= std::numeric_limits::max()); + return static_cast(value); } else { ASSERT(number->IsHeapNumber()); double value = HeapNumber::cast(number)->value(); + CHECK(value >= 0 && + value <= std::numeric_limits::max()); return static_cast(value); } }