Fix container-overflow in BinaryReaderInterp (#2747) - #2812
Conversation
When stop_on_first_error=false, a failed OnFunction left module_.funcs empty while OnFunctionCount had reserved capacity. BeginFunctionBody then wrote past the vector's logical end (ASan container-overflow). Add OnFunctionBodyCount guard matching the established BinaryReaderIR pattern, adapted for interp where module_.funcs holds defined funcs only. Fixes WebAssembly#2747 Signed-off-by: Gaurav Chaudhary <chaudharygaurav2004@gmail.com>
Wrap comments and reformat the PoC byte array to satisfy scripts/clang-format-diff.sh. Signed-off-by: Gaurav Chaudhary <chaudharygaurav2004@gmail.com>
|
If this only applies with |
|
@sbc100 You're right — I rechecked and this only reproduces with So this isn't a bug in the supported interpreter path. I'll close this PR (and #2747) as not applicable. Thanks for the clarification. |
|
We should probably add an assert or something if interp (or other tools) are used with |
|
i.e. only certain readers are compatible with this mode and we should make that more clear |
|
@sbc100 Makes sense. Happy to follow up with a small PR that asserts (or returns Error) in ReadBinaryInterp when stop_on_first_error=false, plus a short comment that only readers designed for collect-errors mode (e.g. Should that be assert-only (debug), or also reject in release builds? |
2 participants
Fixes #2747
Summary
OnFunctionBodyCountguard toBinaryReaderInterpto prevent container-overflow whenstop_on_first_error=falseand the Function section fails before allFuncDescentries are appended.count != module_.funcs.size()(interp stores defined funcs only, unlike IR reader).Test plan
./wabt-unittests --gtest_filter='InterpTest.FunctionBodyCountMismatchWithCollectErrors'./wabt-unittestsstop_on_first_error=falsereturns error without crash