commit db5fc682ba0e46ed73a0334a64dac93d6f5ca41b
author Joshua Bell <jsbell@chromium.org> Mon Jul 20 17:58:19 2020
committer Commit Bot <commit-bot@chromium.org> Mon Jul 20 17:58:19 2020
tree af87480645e43d00799b7c0b8bb93097b79df89e
parent 54b81ab56e9fdf52788205dd57153e87cf0e362e

IndexedDB: Impose an arbitrary limit on array key length

During key conversion, where JS values are converted to IDBKey
objects, arrays are converted an element at a time. At the start of
the process an array is allocated and sized. While sparse arrays are
invalid, a sparse array with a ridiculous length could cause OOMs in
the allocator.

Mitigate this by imposing an arbitrary limit on array keys, much as
there is already an arbitrary depth limit. In practice, the limit
should not be hit unless the conversion was going to eventually fail
with OOM anyway.

Bug: 1106710
Change-Id: If2da02a2fc736bead0e962d4ff37ba6aaef0a617
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2304445
Commit-Queue: Joshua Bell <jsbell@chromium.org>
Reviewed-by: Victor Costan <pwnall@chromium.org>
Reviewed-by: Yuki Shiino <yukishiino@chromium.org>
Auto-Submit: Joshua Bell <jsbell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#790000}