Skip to content

Commit

Permalink
Fix memory.grow bounds and overflow checks for mem64 (#7112)
Browse files Browse the repository at this point in the history
Previously the interpreter only executed overflow and bounds checks for
memory.grow on 32-bit memories. Run the checks on 64-bit memories as
well.
  • Loading branch information
tlively authored Nov 25, 2024
1 parent 8265573 commit 7cee025
Show file tree
Hide file tree
Showing 2 changed files with 19 additions and 2 deletions.
9 changes: 7 additions & 2 deletions src/wasm-interpreter.h
Original file line number Diff line number Diff line change
Expand Up @@ -3836,10 +3836,15 @@ class ModuleRunnerBase : public ExpressionRunner<SubType> {
auto fail = Literal::makeFromInt64(-1, memory->addressType);
Flow ret = Literal::makeFromInt64(memorySize, addressType);
uint64_t delta = flow.getSingleValue().getUnsigned();
if (delta > uint32_t(-1) / Memory::kPageSize && addressType == Type::i32) {
uint64_t maxAddr = addressType == Type::i32
? std::numeric_limits<uint32_t>::max()
: std::numeric_limits<uint64_t>::max();
if (delta > maxAddr / Memory::kPageSize) {
// Impossible to grow this much.
return fail;
}
if (memorySize >= uint32_t(-1) - delta && addressType == Type::i32) {
if (memorySize >= maxAddr - delta) {
// Overflow.
return fail;
}
auto newSize = memorySize + delta;
Expand Down
12 changes: 12 additions & 0 deletions test/lit/exec/memory64.wast
Original file line number Diff line number Diff line change
Expand Up @@ -28,12 +28,24 @@
(i32.const 10)
)
)

;; CHECK: [fuzz-exec] calling memory.grow.fail
;; CHECK-NEXT: [fuzz-exec] note result: memory.grow.fail => -1
(func $memory.grow.fail (export "memory.grow.fail") (result i64)
(memory.grow
(i64.const -1)
)
)
)

;; CHECK: [fuzz-exec] calling memory.init.trap
;; CHECK-NEXT: [trap out of bounds segment access in memory.init]

;; CHECK: [fuzz-exec] calling memory.init.trap2
;; CHECK-NEXT: [trap out of bounds segment access in memory.init]

;; CHECK: [fuzz-exec] calling memory.grow.fail
;; CHECK-NEXT: [fuzz-exec] note result: memory.grow.fail => -1
;; CHECK-NEXT: [fuzz-exec] comparing memory.grow.fail
;; CHECK-NEXT: [fuzz-exec] comparing memory.init.trap
;; CHECK-NEXT: [fuzz-exec] comparing memory.init.trap2

0 comments on commit 7cee025

Please sign in to comment.