Security: Make isolates resilient in the face of malformed messages

[turnidge]

If an attacker is able to specify the raw stream of a serialized message (e.g. when a receive port is bound to a tcp port) and the message is read in Snapshot::SetupFromMemory, security problems can occur:
Missing check for length
Potentially missing checks for type (kind) of message (should be restricted to kMessage)

Once first security checks are implemented, the functionality should be fuzzed
If a malformed message is detected, the message potentially can be dropped

Reviewer also suggests this...

Snapshots should be redesigned so that code (type code) and data (type message) are treated differently

...but I'm not sure that this is an issue for us.

[iposva-google]

Added Security label.

[sigmundch]

Added Isolates label.

[iposva-google]

Added this to the M1 milestone.

[turnidge]

I am in the process of adding code to make all messages keep an external length, so we don't have to rely on the self-reported length of the messages. After this is done, I will hand this bug off to Siva.

---

cc @a-siva.
Set owner to @turnidge.
Added Started label.

[turnidge]

I have added code that makes the VM pass along a trusted size with all messages.

Siva, I'm assigning this bug to you now. Can you make the message parsing itself resilient in the face of malformed input?

---

Set owner to @a-siva.

[turnidge]

Removed this from the M1 milestone.
Added this to the M2 milestone.

[sigmundch]

Added Library-Isolates label.

[sigmundch]

Removed Isolates label.

[a-siva]

Added Accepted label.

[iposva-google]

Removed this from the M2 milestone.
Added this to the M3 milestone.

[dgrove]

Added Library-Isolate label.

[dgrove]

Removed Library-Isolates label.

[iposva-google]

Removed this from the M3 milestone.
Added this to the M4 milestone.

[larsbak]

Removed this from the M4 milestone.
Added this to the M5 milestone.

[a-siva]

Issue #0 has been merged into this issue.

---

cc @kasperl.

[iposva-google]

Removed Priority-Medium label.
Added Priority-Unassigned label.

[iposva-google]

Removed this from the M5 milestone.

[iposva-google]

Currently there is no functionality to inject messages to the isolate from the outside (through TCP or raw Dart code). The only way is to deliver messages using the C based API and at that point you were already in C.

Siva, is there anything for us to do here in the short term?

[mraleph]

It does not seem like we are planning anything in this area. @a-siva please reopen if you think we would work on this.