tree 13e59c1f007298faa25f663ae20814c3502bf406
parent 2acb366b7e47ec278966202971dbd720b9159598
author Bryan Ferris <bferris@google.com> 1551838011 -0800
committer Manjae Park <manjaepark@google.com> 1552444468 -0700

Fix Integer Overflow in libpac

From the upstream patch
(https://chromium.googlesource.com/v8/v8.git/+/7b27040e66c8a83006aebc90fe97d21bb42156a7%5E%21/#F0):

"""
Harden JSFunction::CalculateInstanceSizeHelper(...)
"""

Bug: 117556220

Test: /data/local/nativetest/proxy_resolver_v8_unittest/proxy_resolver_v8_unittest

Test: gts-tradefed run gts --test \
  com.google.android.gts.devicepolicy.DeviceOwnerTest#testProxyPacProxyTest \
  --module GtsGmscoreHostTestCases

Test: PoC from bug report

Merged-In: I2e02d994f107e64e4f465b4d8a02d4159a95240e

Change-Id: I72321236f4d4cf8da993addc3ef7a1dc018c434b
(cherry picked from commit cc15c8f69c835e5c1fcfd4992cb21adbda41bd03)