Security: Avoid bad range check pattern

[turnidge]

The following are two examples of code that uses a bad range check pattern:

• DART_EXPORT Dart_Handle Dart_ListGetAsBytes(Dart_Handle list,
                                              intptr_t offset,
                                              uint8_t* native_array,
                                              intptr_t length) {
    Isolate* isolate = Isolate::Current();
    DARTSCOPE(isolate);
    const Object& obj = Object::Handle(Api::UnwrapHandle(list));
    if (obj.IsArray()) {
      Array& array_obj = Array::Handle();
      array_obj ^= obj.raw();
      if ((offset + length) <= array_obj.Length()) {
        Object& element = Object::Handle();
• byte_array.cc:
    static void RangeCheck(const ByteArray& array, const Smi& index,
                         intptr_t num_bytes) {
    if ((index.Value() < 0) || ((index.Value() + num_bytes) > array.Length())) {

[iposva-google]

Added Security label.

[iposva-google]

Set owner to @a-siva.
Added this to the M1 milestone.
Added Accepted label.

[turnidge]

Set owner to @turnidge.

[iposva-google]

Removed this from the M1 milestone.
Added this to the M2 milestone.

[iposva-google]

Removed this from the M2 milestone.
Added this to the M3 milestone.

[iposva-google]

Removed this from the M3 milestone.
Added this to the M4 milestone.

[larsbak]

Removed this from the M4 milestone.
Added this to the M5 milestone.

[iposva-google]

Removed Priority-Medium label.
Added Priority-Unassigned label.

[iposva-google]

Removed this from the M5 milestone.

[iposva-google]

// Perform a range check, checking if
// offset + count <= length
// without the risk of integer overflow.
static inline bool RangeCheck(intptr_t offset,
intptr_t count,
intptr_t length) {
return offset >= 0 &&
count >= 0 &&
length >= 0 &&
count <= (length - offset);
}