From 099056b076626c0f9df5664f1484f76e1c4d5ee5 Mon Sep 17 00:00:00 2001 From: "liang.he" Date: Fri, 3 Jan 2025 14:37:09 +0800 Subject: [PATCH] Ensure __heap_base and __data_end global indices are validated against import count (#3996) --- core/iwasm/interpreter/wasm_loader.c | 14 ++++++++++++++ core/iwasm/interpreter/wasm_mini_loader.c | 12 ++++++++++++ 2 files changed, 26 insertions(+) diff --git a/core/iwasm/interpreter/wasm_loader.c b/core/iwasm/interpreter/wasm_loader.c index 91237c007..e01e17fe9 100644 --- a/core/iwasm/interpreter/wasm_loader.c +++ b/core/iwasm/interpreter/wasm_loader.c @@ -5927,6 +5927,13 @@ load_from_sections(WASMModule *module, WASMSection *sections, for (i = 0; i < module->export_count; i++, export ++) { if (export->kind == EXPORT_KIND_GLOBAL) { if (!strcmp(export->name, "__heap_base")) { + if (export->index < module->import_global_count) { + LOG_DEBUG("Skip the process if __heap_base is imported " + "instead of being a local global"); + continue; + } + + /* only process linker-generated symbols */ global_index = export->index - module->import_global_count; global = module->globals + global_index; if (global->type.val_type == VALUE_TYPE_I32 @@ -5941,6 +5948,13 @@ load_from_sections(WASMModule *module, WASMSection *sections, } } else if (!strcmp(export->name, "__data_end")) { + if (export->index < module->import_global_count) { + LOG_DEBUG("Skip the process if __data_end is imported " + "instead of being a local global"); + continue; + } + + /* only process linker-generated symbols */ global_index = export->index - module->import_global_count; global = module->globals + global_index; if (global->type.val_type == VALUE_TYPE_I32 diff --git a/core/iwasm/interpreter/wasm_mini_loader.c b/core/iwasm/interpreter/wasm_mini_loader.c index 4dad55523..de9e22018 100644 --- a/core/iwasm/interpreter/wasm_mini_loader.c +++ b/core/iwasm/interpreter/wasm_mini_loader.c @@ -2736,6 +2736,12 @@ load_from_sections(WASMModule *module, WASMSection *sections, for (i = 0; i < module->export_count; i++, export ++) { if (export->kind == EXPORT_KIND_GLOBAL) { if (!strcmp(export->name, "__heap_base")) { + if (export->index < module->import_global_count) { + LOG_DEBUG("Skip the process if __heap_base is imported " + "instead of being a local global"); + continue; + } + global_index = export->index - module->import_global_count; global = module->globals + global_index; if (global->type.val_type == VALUE_TYPE_I32 @@ -2750,6 +2756,12 @@ load_from_sections(WASMModule *module, WASMSection *sections, } } else if (!strcmp(export->name, "__data_end")) { + if (export->index < module->import_global_count) { + LOG_DEBUG("Skip the process if __data_end is imported " + "instead of being a local global"); + continue; + } + global_index = export->index - module->import_global_count; global = module->globals + global_index; if (global->type.val_type == VALUE_TYPE_I32