heap-buffer-overflow in wasm_loader_prepare_bytecode

[haruki3hhh]

Version

commit d6d5072 (HEAD -> main, origin/main, origin/HEAD)

Compile

cd wasm-micro-runtime/product-mini/platforms/linux/
cmake -DCMAKE_C_COMPILER="gcc" -DCMAKE_C_FLAGS="-g -fsanitize=address -fno-omit-frame-pointer" -DCMAKE_LINKER_FLAGS="-g -fsanitize=address -fno-omit-frame-pointer" ..
make -j

ASAN Log

=================================================================
==1704==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000000120 at pc 0x55b561c1c390 bp 0x7ffe52757130 sp 0x7ffe52757120
WRITE of size 2 at 0x606000000120 thread T0
    #0 0x55b561c1c38f in wasm_loader_prepare_bytecode /root/Ablation/wasm-micro-runtime/core/iwasm/interpreter/wasm_loader.c:7698
    #1 0x55b561c1c38f in load_from_sections /root/Ablation/wasm-micro-runtime/core/iwasm/interpreter/wasm_loader.c:3852
    #2 0x55b561c246b4 in load /root/Ablation/wasm-micro-runtime/core/iwasm/interpreter/wasm_loader.c:4215
    #3 0x55b561c246b4 in wasm_loader_load /root/Ablation/wasm-micro-runtime/core/iwasm/interpreter/wasm_loader.c:4391
    #4 0x55b561b9a71c in main /root/Ablation/wasm-micro-runtime/product-mini/platforms/linux/../posix/main.c:885
    #5 0x7f9eb91d2082 in __libc_start_main ../csu/libc-start.c:308
    #6 0x55b561b9bb4d in _start (/root/Ablation/wasm-micro-runtime/product-mini/platforms/linux/build_asan/iwasm+0x22b4d)

0x606000000120 is located 0 bytes to the right of 64-byte region [0x6060000000e0,0x606000000120)
allocated by thread T0 here:
    #0 0x7f9eb9625808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
    #1 0x55b561c12ed3 in loader_malloc /root/Ablation/wasm-micro-runtime/core/iwasm/interpreter/wasm_loader.c:285
    #2 0x55b561c12ed3 in wasm_loader_ctx_init /root/Ablation/wasm-micro-runtime/core/iwasm/interpreter/wasm_loader.c:5594
    #3 0x55b561c12ed3 in wasm_loader_prepare_bytecode /root/Ablation/wasm-micro-runtime/core/iwasm/interpreter/wasm_loader.c:7513
    #4 0x55b561c12ed3 in load_from_sections /root/Ablation/wasm-micro-runtime/core/iwasm/interpreter/wasm_loader.c:3852
    #5 0x55b561c246b4 in load /root/Ablation/wasm-micro-runtime/core/iwasm/interpreter/wasm_loader.c:4215
    #6 0x55b561c246b4 in wasm_loader_load /root/Ablation/wasm-micro-runtime/core/iwasm/interpreter/wasm_loader.c:4391
    #7 0x55b561b9a71c in main /root/Ablation/wasm-micro-runtime/product-mini/platforms/linux/../posix/main.c:885
    #8 0x7f9eb91d2082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/Ablation/wasm-micro-runtime/core/iwasm/interpreter/wasm_loader.c:7698 in wasm_loader_prepare_bytecode

Reproduce

./iwasm id:000015,sig:06,src:001496,op:python,pos:0

PoC

id:000015,sig:06,src:001496,op:python,pos:0

[wenyongh]

@haruki3hhh Thanks for reporting the issue, it was fixed with #3149, please try again.

[wenyongh]

Close this issue since it was resolved.