gnh1201/wasm-micro-runtime
1
0
Fork 0
mirror of https://github.com/bytecodealliance/wasm-micro-runtime.git synced 2024-10-16 13:02:32 +00:00
Code Issues Actions 14 Packages Projects Releases Wiki Activity

Fix out-of-bounds read in wasm loader (#156)

Browse Source
This commit is contained in:
greenknot 2020-01-17 06:38:21 +01:00 committed by wenyongh
parent aa24fc5e0f
commit 2a4528c749
1 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
core/iwasm/runtime/vmcore-wasm/wasm_loader.c
View File

@ -55,7 +55,15 @@ read_leb(const uint8 *buf, const uint8 *buf_end,
uint64 byte;
while (true) {
CHECK_BUF(buf, buf_end, 1);
/* Check if the byte count exteeds the max byte count allowed */
if (bcnt + 1 > (maxbits + 6) / 7) {
set_error_buf(error_buf, error_buf_size,
"WASM module load failed: "
"integer representation too long");
return false;
}
/* Check buffer */
CHECK_BUF(buf, buf_end, *p_offset + 1);
byte = buf[*p_offset];
*p_offset += 1;
result |= ((byte & 0x7f) << shift);
@ -66,13 +74,6 @@ read_leb(const uint8 *buf, const uint8 *buf_end,
}
}
if (bcnt > (maxbits + 6) / 7) {
set_error_buf(error_buf, error_buf_size,
"WASM module load failed: "
"integer representation too long");
return false;
}
if (!sign && maxbits == 32 && shift >= maxbits) {
/* The top bits set represent values > 32 bits */
if (((uint8)byte) & 0xf0)