From 11cc5a26d51bb707e6e40c796827f5b3a9b6be04 Mon Sep 17 00:00:00 2001
From: David Symonds <dsymonds@golang.org>
Date: Fri, 16 Mar 2012 17:28:16 +1100
Subject: [PATCH] reflect: panic if MakeSlice is given bad len/cap arguments.

Fixes #3330.

R=golang-dev, r
CC=golang-dev
https://golang.org/cl/5847043
---
 src/pkg/reflect/value.go | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/pkg/reflect/value.go b/src/pkg/reflect/value.go
index 3974d02b717f1..79476ad2298bc 100644
--- a/src/pkg/reflect/value.go
+++ b/src/pkg/reflect/value.go
@@ -1632,6 +1632,15 @@ func MakeSlice(typ Type, len, cap int) Value {
 	if typ.Kind() != Slice {
 		panic("reflect.MakeSlice of non-slice type")
 	}
+	if len < 0 {
+		panic("reflect.MakeSlice: negative len")
+	}
+	if cap < 0 {
+		panic("reflect.MakeSlice: negative cap")
+	}
+	if len > cap {
+		panic("reflect.MakeSlice: len > cap")
+	}
 
 	// Declare slice so that gc can see the base pointer in it.
 	var x []byte