Security: Check for negative return value from OS::SNPrint #1745
Description
The return value of OS::SNPrint (which boils down to vsnprintf) is always assumed to contain the number of bytes occupied by formatted output, whereas it can sometimes contain a negative value (typically -1) due to an error condition. Example (dart/runtime/lib/isolate.cc, function BuildIsolateName):
const char* kFormat = "%s/%s.%s";
intptr_t len = OS::SNPrint(NULL, 0, kFormat, script_name, class_name,
func_name) + 1;
char* chars = reinterpret_cast<char*>(
Isolate::Current()->current_zone()->Allocate(len));
OS::SNPrint(chars, len, kFormat, script_name, class_name, func_name);
return chars;