Skip to content

Fix crash issue if wasm file is malformed(armv7 32bit) #853

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 22 commits into from
Nov 30, 2021
Merged

Fix crash issue if wasm file is malformed(armv7 32bit) #853

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
0435e61
Add custom name section to aot file, Fix some typos, Update .gitignore
JavanZhu Oct 20, 2021
6ab6cc3
Fix some typos.
JavanZhu Oct 20, 2021
598e8f9
Merge branch 'main' of https://github.com/JavanZhu/wasm-micro-runtime
JavanZhu Oct 20, 2021
0b22e34
Update.
JavanZhu Oct 22, 2021
d05f09d
Fix typo.
JavanZhu Oct 22, 2021
d3d1480
Fix.
JavanZhu Oct 22, 2021
ac4495a
Format code.
JavanZhu Oct 22, 2021
89331b3
Fix build error.
JavanZhu Oct 22, 2021
6d46299
Merge branch 'bytecodealliance:main' into main
JavanZhu Oct 22, 2021
1f49189
Replace leb with uint32.
JavanZhu Oct 25, 2021
e4db19d
Fix compiler warning.
JavanZhu Oct 25, 2021
a103f0d
Fix reviews.
JavanZhu Oct 26, 2021
1193463
Fix review.
JavanZhu Oct 26, 2021
2930c7b
Merge branch 'bytecodealliance:main' into main
JavanZhu Oct 26, 2021
ddcea32
Merge branch 'bytecodealliance:main' into main
JavanZhu Nov 5, 2021
fd3e2fd
Merge branch 'bytecodealliance:main' into main
JavanZhu Nov 10, 2021
a9c004f
Merge branch 'bytecodealliance:main' into main
JavanZhu Nov 26, 2021
7b5283a
Fix crash issue if the wasm file is malformed.
JavanZhu Nov 26, 2021
60ffa52
Fix.
JavanZhu Nov 29, 2021
fe8674e
Update aot_loader.c
wenyongh Nov 30, 2021
f22f614
Update wasm_loader.c
wenyongh Nov 30, 2021
151c1ae
Update wasm_mini_loader.c
wenyongh Nov 30, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion core/iwasm/aot/aot_loader.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ static bool
check_buf(const uint8 *buf, const uint8 *buf_end, uint32 length,
char *error_buf, uint32 error_buf_size)
{
if (buf + length > buf_end) {
if (buf + length < buf || buf + length > buf_end) {
set_error_buf(error_buf, error_buf_size, "unexpect end");
return false;
}
Expand Down
6 changes: 2 additions & 4 deletions core/iwasm/interpreter/wasm_loader.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ static bool
check_buf(const uint8 *buf, const uint8 *buf_end, uint32 length,
char *error_buf, uint32 error_buf_size)
{
if (buf + length > buf_end) {
if (buf + length < buf || buf + length > buf_end) {
set_error_buf(error_buf, error_buf_size,
"unexpected end of section or function");
return false;
Expand All @@ -59,7 +59,7 @@ static bool
check_buf1(const uint8 *buf, const uint8 *buf_end, uint32 length,
char *error_buf, uint32 error_buf_size)
{
if (buf + length > buf_end) {
if (buf + length < buf || buf + length > buf_end) {
set_error_buf(error_buf, error_buf_size, "unexpected end");
return false;
}
Expand Down Expand Up @@ -1034,7 +1034,6 @@ load_function_import(const uint8 **p_buf, const uint8 *buf_end,
bool linked_call_conv_raw = false;
bool is_native_symbol = false;

CHECK_BUF(p, p_end, 1);
read_leb_uint32(p, p_end, declare_type_index);
*p_buf = p;

Expand Down Expand Up @@ -3335,7 +3334,6 @@ create_sections(const uint8 *buf, uint32 size, WASMSection **p_section_list,
}
last_section_index = section_index;
}
CHECK_BUF1(p, p_end, 1);
read_leb_uint32(p, p_end, section_size);
CHECK_BUF1(p, p_end, section_size);

Expand Down
16 changes: 7 additions & 9 deletions core/iwasm/interpreter/wasm_mini_loader.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,14 +25,14 @@ set_error_buf(char *error_buf, uint32 error_buf_size, const char *string)
string);
}

#define CHECK_BUF(buf, buf_end, length) \
do { \
bh_assert(buf + length <= buf_end); \
#define CHECK_BUF(buf, buf_end, length) \
do { \
bh_assert(buf + length >= buf && buf + length <= buf_end); \
} while (0)

#define CHECK_BUF1(buf, buf_end, length) \
do { \
bh_assert(buf + length <= buf_end); \
#define CHECK_BUF1(buf, buf_end, length) \
do { \
bh_assert(buf + length >= buf && buf + length <= buf_end); \
} while (0)

#define skip_leb(p) while (*p++ & 0x80)
Expand All @@ -45,7 +45,7 @@ is_32bit_type(uint8 type)
{
if (type == VALUE_TYPE_I32 || type == VALUE_TYPE_F32
#if WASM_ENABLE_REF_TYPES != 0
|| type == VALUE_TYPE_FUNCREF || type == VALUE_TYPE_EXTERNREF)
|| type == VALUE_TYPE_FUNCREF || type == VALUE_TYPE_EXTERNREF
#endif
)
return true;
Expand Down Expand Up @@ -412,7 +412,6 @@ load_function_import(const uint8 **p_buf, const uint8 *buf_end,
void *linked_attachment = NULL;
bool linked_call_conv_raw = false;

CHECK_BUF(p, p_end, 1);
read_leb_uint32(p, p_end, declare_type_index);
*p_buf = p;

Expand Down Expand Up @@ -2232,7 +2231,6 @@ create_sections(const uint8 *buf, uint32 size, WASMSection **p_section_list,
|| last_section_index < section_index);
last_section_index = section_index;
}
CHECK_BUF1(p, p_end, 1);
read_leb_uint32(p, p_end, section_size);
CHECK_BUF1(p, p_end, section_size);

Expand Down