Fix #1563. overflow in ChildProcess custom_fd.

Backported from master f5db3f1

Author: ry

src/node_child_process.cc

@@ -164,7 +164,13 @@ Handle<Value> ChildProcess::Spawn(const Arguments& args) {
   if (args[4]->IsArray()) {
     // Set the custom file descriptor values (if any) for the child process
     Local<Array> custom_fds_handle = Local<Array>::Cast(args[4]);
+
     int custom_fds_len = custom_fds_handle->Length();
+    // Bound by 3.
+    if (custom_fds_len > 3) {
+      custom_fds_len = 3;
+    }
+
     for (int i = 0; i < custom_fds_len; i++) {
       if (custom_fds_handle->Get(i)->IsUndefined()) continue;
       Local<Integer> fd = custom_fds_handle->Get(i)->ToInteger();

test/simple/test-child-process-customfd-bounded.js

@@ -0,0 +1,9 @@
+var common = require('../common');
+var spawn = require('child_process').spawn;
+var bigish = Array(200);
+
+for (var i = 0, il = bigish.length; i < il; ++i)
+ bigish[i] = -1;
+
+spawn('/bin/echo', [], { customFds: bigish });
+