aot loader: Verify global value type (#3560 )

Fix issue reported by Oss-fuzz test (#69798). https://oss-fuzz.com/testcase-detail/5963842371256320
aot loader: Add more checks in load_native_symbol_section() (#3559 )
2025-07-12 15:33:16 +00:00 · 2024-06-24 10:34:03 +08:00 · 2024-06-24 10:07:10 +08:00
1 changed files with 9 additions and 3 deletions
--- a/core/iwasm/aot/aot_loader.c
+++ b/core/iwasm/aot/aot_loader.c
@ -660,15 +660,18 @@ load_native_symbol_section(const uint8 *buf, const uint8 *buf_end,
    read_uint32(p, p_end, cnt);

    if (cnt > 0) {
-        module->native_symbol_list = wasm_runtime_malloc(cnt * sizeof(void *));
+        uint64 list_size = cnt * (uint64)sizeof(void *);
+        module->native_symbol_list =
+            loader_malloc(list_size, error_buf, error_buf_size);
        if (module->native_symbol_list == NULL) {
-            set_error_buf(error_buf, error_buf_size,
-                          "malloc native symbol list failed");
            goto fail;
        }

        for (i = cnt - 1; i >= 0; i--) {
            read_string(p, p_end, symbol);
+            if (!strlen(symbol))
+                continue;
+
            if (!strncmp(symbol, "f32#", 4) || !strncmp(symbol, "i32#", 4)) {
                uint32 u32;
                /* Resolve the raw int bits of f32 const */
@ -2167,6 +2170,9 @@ load_globals(const uint8 **p_buf, const uint8 *buf_end, AOTModule *module,
        read_uint8(buf, buf_end, globals[i].type.val_type);
        read_uint8(buf, buf_end, globals[i].type.is_mutable);

+        if (!is_valid_value_type(globals[i].type.val_type))
+            return false;
+
        buf = align_ptr(buf, 4);

        if (!load_init_expr(&buf, buf_end, module, &globals[i].init_expr,
Author	SHA1	Message	Date
liang.he	cfffb62ad2	aot loader: Verify global value type (#3560 ) Some checks are pending compilation on SGX / build_iwasm (-DWAMR_DISABLE_HW_BOUND_CHECK=1, $FAST_JIT_BUILD_OPTIONS, ubuntu-20.04, linux-sgx) (push) Waiting to run Details compilation on SGX / run_samples_file (-DWAMR_BUILD_SGX_IPFS=1, $AOT_BUILD_OPTIONS, ${{ needs.build_llvm_libraries.outputs.cache_key }}, ubuntu-20.04, linux-sgx, https://github.com/WebAssembly/wabt/releases/download/1.0.31/wabt-1.0.31-ubuntu.tar.gz, https://github.com/WebA… (push) Blocked by required conditions Details compilation on SGX / run_samples_file (-DWAMR_BUILD_SGX_IPFS=1, $CLASSIC_INTERP_BUILD_OPTIONS, ${{ needs.build_llvm_libraries.outputs.cache_key }}, ubuntu-20.04, linux-sgx, https://github.com/WebAssembly/wabt/releases/download/1.0.31/wabt-1.0.31-ubuntu.tar.gz, https://gith… (push) Blocked by required conditions Details compilation on SGX / run_samples_file (-DWAMR_BUILD_SGX_IPFS=1, $FAST_INTERP_BUILD_OPTIONS, ${{ needs.build_llvm_libraries.outputs.cache_key }}, ubuntu-20.04, linux-sgx, https://github.com/WebAssembly/wabt/releases/download/1.0.31/wabt-1.0.31-ubuntu.tar.gz, https://github.… (push) Blocked by required conditions Details compilation on SGX / run_samples_file (-DWAMR_BUILD_SGX_IPFS=1, $FAST_JIT_BUILD_OPTIONS, ${{ needs.build_llvm_libraries.outputs.cache_key }}, ubuntu-20.04, linux-sgx, https://github.com/WebAssembly/wabt/releases/download/1.0.31/wabt-1.0.31-ubuntu.tar.gz, https://github.com… (push) Blocked by required conditions Details compilation on SGX / spec_test_default (${{ needs.build_llvm_libraries.outputs.cache_key }}, aot, -x -p -s spec -P) (push) Blocked by required conditions Details compilation on SGX / spec_test_default (${{ needs.build_llvm_libraries.outputs.cache_key }}, aot, -x -p -s spec -S -P) (push) Blocked by required conditions Details compilation on SGX / spec_test_default (${{ needs.build_llvm_libraries.outputs.cache_key }}, aot, -x -p -s spec -X -P) (push) Blocked by required conditions Details compilation on SGX / spec_test_default (${{ needs.build_llvm_libraries.outputs.cache_key }}, classic-interp, -x -p -s spec -P) (push) Blocked by required conditions Details compilation on SGX / spec_test_default (${{ needs.build_llvm_libraries.outputs.cache_key }}, fast-interp, -x -p -s spec -P) (push) Blocked by required conditions Details compilation on SGX / spec_test_default (${{ needs.build_llvm_libraries.outputs.cache_key }}, fast-jit, -x -p -s spec -P) (push) Blocked by required conditions Details compilation on windows-latest / build (-DWAMR_BUILD_AOT=0) (push) Waiting to run Details compilation on windows-latest / build (-DWAMR_BUILD_AOT=1 -DWAMR_BUILD_INTERP=0) (push) Waiting to run Details compilation on windows-latest / build (-DWAMR_BUILD_CUSTOM_NAME_SECTION=1) (push) Waiting to run Details compilation on windows-latest / build (-DWAMR_BUILD_DEBUG_INTERP=1) (push) Waiting to run Details compilation on windows-latest / build (-DWAMR_BUILD_LIBC_UVWASI=0 -DWAMR_BUILD_LIBC_WASI=1) (push) Waiting to run Details compilation on windows-latest / build (-DWAMR_BUILD_LIB_PTHREAD=1) (push) Waiting to run Details compilation on windows-latest / build (-DWAMR_BUILD_LIB_WASI_THREADS=1) (push) Waiting to run Details compilation on windows-latest / build (-DWAMR_BUILD_REF_TYPES=1) (push) Waiting to run Details compilation on windows-latest / build (-DWAMR_BUILD_SIMD=1) (push) Waiting to run Details compilation on windows-latest / build (-DWAMR_BUILD_TAIL_CALL=1) (push) Waiting to run Details compilation on windows-latest / build (-DWAMR_DISABLE_HW_BOUND_CHECK=1) (push) Waiting to run Details compilation on windows-latest / test (classic-interp, $DEFAULT_TEST_OPTIONS) (push) Blocked by required conditions Details compilation on windows-latest / test (classic-interp, $MULTI_MODULES_TEST_OPTIONS) (push) Blocked by required conditions Details compilation on windows-latest / test (classic-interp, $THREADS_TEST_OPTIONS) (push) Blocked by required conditions Details compilation on windows-latest / test (classic-interp, $WASI_TEST_OPTIONS) (push) Blocked by required conditions Details compilation on windows-latest / test (fast-interp, $DEFAULT_TEST_OPTIONS) (push) Blocked by required conditions Details compilation on windows-latest / test (fast-interp, $MULTI_MODULES_TEST_OPTIONS) (push) Blocked by required conditions Details compilation on windows-latest / test (fast-interp, $THREADS_TEST_OPTIONS) (push) Blocked by required conditions Details compilation on windows-latest / test (fast-interp, $WASI_TEST_OPTIONS) (push) Blocked by required conditions Details Fix issue reported by Oss-fuzz test (#69798). https://oss-fuzz.com/testcase-detail/5963842371256320	2024-06-24 10:34:03 +08:00
liang.he	95f7717555	aot loader: Add more checks in `load_native_symbol_section()` (#3559 ) Fix issue reported by Oss-fuzz test (#69675).	2024-06-24 10:07:10 +08:00