reflect: panic if MakeSlice is given bad len/cap arguments.

Fixes #3330.

R=golang-dev, r
CC=golang-dev
https://golang.org/cl/5847043

diff --git a/src/pkg/reflect/value.go b/src/pkg/reflect/value.go
index 3974d02b717f11521bbbce2c4ef0c35e82bc1498..79476ad2298bc587ce72992aabc52f2fb61fe002 100644 (file)
--- a/src/pkg/reflect/value.go
+++ b/src/pkg/reflect/value.go
@@ -1632,6 +1632,15 @@ func MakeSlice(typ Type, len, cap int) Value {
        if typ.Kind() != Slice {
                panic("reflect.MakeSlice of non-slice type")
        }
+       if len < 0 {
+               panic("reflect.MakeSlice: negative len")
+       }
+       if cap < 0 {
+               panic("reflect.MakeSlice: negative cap")
+       }
+       if len > cap {
+               panic("reflect.MakeSlice: len > cap")
+       }
 
        // Declare slice so that gc can see the base pointer in it.
        var x []byte