diff options
author | Rubin Xu <rubinxu@google.com> | 2020-06-02 05:22:45 +0000 |
---|---|---|
committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2020-06-02 05:22:45 +0000 |
commit | eb67a3c29d0dfb29b3704e672ceeab146185c80b (patch) | |
tree | 25388490ca2517f7c4cd55d06f0e8d652ce90adc | |
parent | de12f154b27eaacf8aaa79f05db781683f3e088b (diff) | |
parent | 97572ddffc588d4bc2778f5d5138d302bc131ab2 (diff) | |
download | v8-eb67a3c29d0dfb29b3704e672ceeab146185c80b.tar.gz |
Fix integer overflow in NewFixedDoubleArray am: 0809cf96aa am: 0100d69c5c am: 97572ddffcandroid-mainline-11.0.0_r35
Original change: undetermined
Change-Id: I7d308cac966e6237d6a84a8c8079971fc6f3d61d
-rw-r--r-- | src/heap/factory.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/heap/factory.cc b/src/heap/factory.cc index c8528f9f..2ac0d990 100644 --- a/src/heap/factory.cc +++ b/src/heap/factory.cc @@ -469,7 +469,7 @@ Handle<FixedArrayBase> Factory::NewFixedDoubleArray(int length, PretenureFlag pretenure) { DCHECK_LE(0, length); if (length == 0) return empty_fixed_array(); - if (length > FixedDoubleArray::kMaxLength) { + if (length < 0 || length > FixedDoubleArray::kMaxLength) { isolate()->heap()->FatalProcessOutOfMemory("invalid array length"); } int size = FixedDoubleArray::SizeFor(length); |