Reland "[wasm] Gracefully handle malformed custom sections in WebAssembly.Module.customSections()."

This is a reland of 163c1c82
Original change's description:
> [wasm] Gracefully handle malformed custom sections in WebAssembly.Module.customSections().
> 
> R=clemensh@chromium.org
> BUG=chromium:789952
> 
> Change-Id: Ida627fa6cdeacff01a0ec4d20e58281f17528010
> Reviewed-on: https://chromium-review.googlesource.com/800941
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Commit-Queue: Ben Titzer <titzer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49767}

Bug: chromium:789952
Change-Id: Ie17629b3fcbf2d5f78c83be2aa2a6b904a61f3ab
Reviewed-on: https://chromium-review.googlesource.com/803575
Commit-Queue: Ben L. Titzer <titzer@google.com>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49796}

src/wasm/module-decoder.cc

@@ -1544,8 +1544,13 @@ std::vector<CustomSectionOffset> DecodeCustomSections(const byte* start,
     uint32_t name_offset = decoder.pc_offset();
     decoder.consume_bytes(name_length, "section name");
     uint32_t payload_offset = decoder.pc_offset();
+    if (section_length < (payload_offset - section_start)) {
+      decoder.error("invalid section length");
+      break;
+    }
     uint32_t payload_length = section_length - (payload_offset - section_start);
     decoder.consume_bytes(payload_length);
+    if (decoder.failed()) break;
     result.push_back({{section_start, section_length},
                       {name_offset, name_length},
                       {payload_offset, payload_length}});

test/mjsunit/regress/wasm/regress-789952.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let module_size = 19;
+let string_len = 0x00fffff0 - module_size;
+
+print("Allocating backing store: " + (string_len + module_size));
+let backing = new ArrayBuffer(string_len + module_size);
+
+print("Allocating typed array buffer");
+let buffer = new Uint8Array(backing);
+
+print("Filling...");
+buffer.fill(0x41);
+
+print("Setting up array buffer");
+// Magic
+buffer.set([0x00, 0x61, 0x73, 0x6D], 0);
+// Version
+buffer.set([0x01, 0x00, 0x00, 0x00], 4);
+// kUnknownSection (0)
+buffer.set([0], 8);
+// Section length
+buffer.set([0x80, 0x80, 0x80, 0x80, 0x00],  9);
+// Name length
+let x = string_len + 1;
+let b1 = ((x >> 0) & 0x7F) | 0x80;
+let b2 = ((x >> 7) & 0x7F) | 0x80;
+let b3 = ((x >> 14) & 0x7F) | 0x80;
+let b4 = ((x >> 21) & 0x7F);
+//buffer.set([0xDE, 0xFF, 0xFF, 0x7F], 14);
+ buffer.set([b1, b2, b3, b4], 14);
+
+print("Parsing module...");
+let m = new WebAssembly.Module(buffer);
+
+print("Triggering!");
+let c = WebAssembly.Module.customSections(m, "A".repeat(string_len + 1));
+assertEquals(0, c.length);