Compare commits

...

2 Commits

Author SHA1 Message Date
Zhenwei Jin
334d60b35a
Merge 3ffc82b1f6 into 9e92f5ebe1 2025-07-10 08:30:30 +08:00
zhenweijin
3ffc82b1f6 add validation for recursive type count in loader 2025-07-07 13:34:08 +08:00

View File

@ -400,7 +400,8 @@ check_array_type(const WASMModule *module, uint32 type_index, char *error_buf,
error_buf_size)) { error_buf_size)) {
return false; return false;
} }
if (module->types[type_index]->type_flag != WASM_TYPE_ARRAY) { if (module->types[type_index] == NULL
|| module->types[type_index]->type_flag != WASM_TYPE_ARRAY) {
set_error_buf(error_buf, error_buf_size, "unknown array type"); set_error_buf(error_buf, error_buf_size, "unknown array type");
return false; return false;
} }
@ -423,7 +424,8 @@ check_function_type(const WASMModule *module, uint32 type_index,
} }
#if WASM_ENABLE_GC != 0 #if WASM_ENABLE_GC != 0
if (module->types[type_index]->type_flag != WASM_TYPE_FUNC) { if (module->types[type_index] == NULL
|| module->types[type_index]->type_flag != WASM_TYPE_FUNC) {
set_error_buf(error_buf, error_buf_size, "unknown function type"); set_error_buf(error_buf, error_buf_size, "unknown function type");
return false; return false;
} }
@ -1255,7 +1257,8 @@ load_init_expr(WASMModule *module, const uint8 **p_buf, const uint8 *buf_end,
error_buf_size)) { error_buf_size)) {
goto fail; goto fail;
} }
if (module->types[type_idx]->type_flag if (module->types[type_idx] == NULL
|| module->types[type_idx]->type_flag
!= WASM_TYPE_STRUCT) { != WASM_TYPE_STRUCT) {
set_error_buf(error_buf, error_buf_size, set_error_buf(error_buf, error_buf_size,
"unknown struct type"); "unknown struct type");
@ -2303,10 +2306,15 @@ load_type_section(const uint8 *buf, const uint8 *buf_end, WASMModule *module,
total_size = new_total_size; total_size = new_total_size;
} }
if (rec_count < 1) {
LOG_VERBOSE("Processing 0-entry rec group");
}
else {
LOG_VERBOSE("Processing rec group [%d-%d]", LOG_VERBOSE("Processing rec group [%d-%d]",
processed_type_count, processed_type_count,
processed_type_count + rec_count - 1); processed_type_count + rec_count - 1);
} }
}
else { else {
p--; p--;
} }
@ -12677,7 +12685,9 @@ re_scan:
error_buf, error_buf_size)) { error_buf, error_buf_size)) {
goto fail; goto fail;
} }
if (module->types[type_idx1]->type_flag != WASM_TYPE_FUNC) { if (module->types[type_idx1] == NULL
|| module->types[type_idx1]->type_flag
!= WASM_TYPE_FUNC) {
set_error_buf(error_buf, error_buf_size, set_error_buf(error_buf, error_buf_size,
"unknown function type"); "unknown function type");
goto fail; goto fail;
@ -12694,7 +12704,9 @@ re_scan:
error_buf, error_buf_size)) { error_buf, error_buf_size)) {
goto fail; goto fail;
} }
if (module->types[type_idx]->type_flag != WASM_TYPE_FUNC) { if (module->types[type_idx] == NULL
|| module->types[type_idx]->type_flag
!= WASM_TYPE_FUNC) {
set_error_buf(error_buf, error_buf_size, set_error_buf(error_buf, error_buf_size,
"unknown function type"); "unknown function type");
goto fail; goto fail;
@ -14533,7 +14545,8 @@ re_scan:
error_buf_size)) { error_buf_size)) {
goto fail; goto fail;
} }
if (module->types[type_idx]->type_flag if (module->types[type_idx] == NULL
|| module->types[type_idx]->type_flag
!= WASM_TYPE_STRUCT) { != WASM_TYPE_STRUCT) {
set_error_buf(error_buf, error_buf_size, set_error_buf(error_buf, error_buf_size,
"unknown struct type"); "unknown struct type");
@ -14620,7 +14633,8 @@ re_scan:
error_buf_size)) { error_buf_size)) {
goto fail; goto fail;
} }
if (module->types[type_idx]->type_flag if (module->types[type_idx] == NULL
|| module->types[type_idx]->type_flag
!= WASM_TYPE_STRUCT) { != WASM_TYPE_STRUCT) {
set_error_buf(error_buf, error_buf_size, set_error_buf(error_buf, error_buf_size,
"unknown struct type"); "unknown struct type");