gnh1201/wasm-micro-runtime
1
0
Fork 0
mirror of https://github.com/bytecodealliance/wasm-micro-runtime.git synced 2025-09-06 01:41:35 +00:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

loader: add type index checking (#4402)

Browse Source
This commit is contained in:
Zhenwei Jin 2025-06-24 20:38:39 +08:00 committed by GitHub
parent e414a327a0
commit 1e41519977
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
core/iwasm/aot/aot_loader.c
View File

@ -1730,6 +1730,12 @@ load_types(const uint8 **p_buf, const uint8 *buf_end, AOTModule *module,
(void)u8; (void)u8;
read_uint32(buf, buf_end, j); read_uint32(buf, buf_end, j);
#if WASM_ENABLE_AOT_VALIDATOR != 0
if (j >= module->type_count) {
set_error_buf(error_buf, error_buf_size, "invalid type index");
goto fail;
}
#endif
if (module->types[j]->ref_count == UINT16_MAX) { if (module->types[j]->ref_count == UINT16_MAX) {
set_error_buf(error_buf, error_buf_size, set_error_buf(error_buf, error_buf_size,
"wasm type's ref count too large"); "wasm type's ref count too large");
@ -1993,6 +1999,13 @@ load_types(const uint8 **p_buf, const uint8 *buf_end, AOTModule *module,
AOTType *cur_type = module->types[j]; AOTType *cur_type = module->types[j];
parent_type_idx = cur_type->parent_type_idx; parent_type_idx = cur_type->parent_type_idx;
if (parent_type_idx != (uint32)-1) { /* has parent */ if (parent_type_idx != (uint32)-1) { /* has parent */
#if WASM_ENABLE_AOT_VALIDATOR != 0
if (parent_type_idx >= module->type_count) {
set_error_buf(error_buf, error_buf_size,
"invalid parent type index");
goto fail;
}
#endif
AOTType *parent_type = module->types[parent_type_idx]; AOTType *parent_type = module->types[parent_type_idx];
module->types[j]->parent_type = parent_type; module->types[j]->parent_type = parent_type;
@ -2016,6 +2029,13 @@ load_types(const uint8 **p_buf, const uint8 *buf_end, AOTModule *module,
AOTType *cur_type = module->types[j]; AOTType *cur_type = module->types[j];
parent_type_idx = cur_type->parent_type_idx; parent_type_idx = cur_type->parent_type_idx;
if (parent_type_idx != (uint32)-1) { /* has parent */ if (parent_type_idx != (uint32)-1) { /* has parent */
#if WASM_ENABLE_AOT_VALIDATOR != 0
if (parent_type_idx >= module->type_count) {
set_error_buf(error_buf, error_buf_size,
"invalid parent type index");
goto fail;
}
#endif
AOTType *parent_type = module->types[parent_type_idx]; AOTType *parent_type = module->types[parent_type_idx];
/* subtyping has been checked during compilation */ /* subtyping has been checked during compilation */
bh_assert(wasm_type_is_subtype_of( bh_assert(wasm_type_is_subtype_of(