Skip to content

Conversation

@wenyongh
Copy link
Contributor

Fix several issues in wasm-c-api wasm_module_imports function:

  1. Two of the if branches never set the module_name and name fields which are later passed as arguments to wasm_importtype_new, and eventually causes double-free and/or use-after-free
  2. Should zero module_name/name/extern_type at the start of loop iteration, and destroy their resources when failed at the end of loop iteration
  3. No need to check if (!extern_type) { continue; }, as extern_type is converted from type and type is already checked
  4. No need to wasm_importtype_vec_delete(out) when failed, as it is passed from outside and should be destroyed by outside

@wenyongh wenyongh merged commit 55ad4c7 into bytecodealliance:main Feb 24, 2022
@wenyongh wenyongh deleted the fix_wasm_c_api branch February 24, 2022 01:58
xujuntwt95329 pushed a commit to xujuntwt95329/wasm-micro-runtime that referenced this pull request Mar 13, 2022
Fix several issues in wasm-c-api wasm_module_imports function:
1. Two of the if branches never set the module_name and name fields which are later passed as arguments to wasm_importtype_new, and eventually might cause double-free and/or use-after-free
2. Should zero module_name/name/extern_type at the start of loop iteration, and destroy their resources when failed at the end of loop iteration
2. No need to check `if (!extern_type) { continue; }`, as extern_type is converted from type and type is already checked
3. No need to wasm_importtype_vec_delete(out) when failed, as it is passed from outside and should be destroyed by outside
vickiegpt pushed a commit to vickiegpt/wamr-aot-gc-checkpoint-restore that referenced this pull request May 27, 2024
Fix several issues in wasm-c-api wasm_module_imports function:
1. Two of the if branches never set the module_name and name fields which are later passed as arguments to wasm_importtype_new, and eventually might cause double-free and/or use-after-free
2. Should zero module_name/name/extern_type at the start of loop iteration, and destroy their resources when failed at the end of loop iteration
2. No need to check `if (!extern_type) { continue; }`, as extern_type is converted from type and type is already checked
3. No need to wasm_importtype_vec_delete(out) when failed, as it is passed from outside and should be destroyed by outside
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant