Ensure __heap_base and __data_end global indices are validated against import count (#3996)

This commit is contained in:
liang.he 2025-01-03 14:37:09 +08:00 committed by GitHub
parent 31ff576edf
commit 099056b076
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 26 additions and 0 deletions

View File

@ -5927,6 +5927,13 @@ load_from_sections(WASMModule *module, WASMSection *sections,
for (i = 0; i < module->export_count; i++, export ++) {
if (export->kind == EXPORT_KIND_GLOBAL) {
if (!strcmp(export->name, "__heap_base")) {
if (export->index < module->import_global_count) {
LOG_DEBUG("Skip the process if __heap_base is imported "
"instead of being a local global");
continue;
}
/* only process linker-generated symbols */
global_index = export->index - module->import_global_count;
global = module->globals + global_index;
if (global->type.val_type == VALUE_TYPE_I32
@ -5941,6 +5948,13 @@ load_from_sections(WASMModule *module, WASMSection *sections,
}
}
else if (!strcmp(export->name, "__data_end")) {
if (export->index < module->import_global_count) {
LOG_DEBUG("Skip the process if __data_end is imported "
"instead of being a local global");
continue;
}
/* only process linker-generated symbols */
global_index = export->index - module->import_global_count;
global = module->globals + global_index;
if (global->type.val_type == VALUE_TYPE_I32

View File

@ -2736,6 +2736,12 @@ load_from_sections(WASMModule *module, WASMSection *sections,
for (i = 0; i < module->export_count; i++, export ++) {
if (export->kind == EXPORT_KIND_GLOBAL) {
if (!strcmp(export->name, "__heap_base")) {
if (export->index < module->import_global_count) {
LOG_DEBUG("Skip the process if __heap_base is imported "
"instead of being a local global");
continue;
}
global_index = export->index - module->import_global_count;
global = module->globals + global_index;
if (global->type.val_type == VALUE_TYPE_I32
@ -2750,6 +2756,12 @@ load_from_sections(WASMModule *module, WASMSection *sections,
}
}
else if (!strcmp(export->name, "__data_end")) {
if (export->index < module->import_global_count) {
LOG_DEBUG("Skip the process if __data_end is imported "
"instead of being a local global");
continue;
}
global_index = export->index - module->import_global_count;
global = module->globals + global_index;
if (global->type.val_type == VALUE_TYPE_I32