Compare commits

...

2 Commits

Author SHA1 Message Date
Zhenwei Jin
334d60b35a
Merge 3ffc82b1f6 into 9e92f5ebe1 2025-07-10 08:30:30 +08:00
zhenweijin
3ffc82b1f6 add validation for recursive type count in loader 2025-07-07 13:34:08 +08:00

View File

@ -400,7 +400,8 @@ check_array_type(const WASMModule *module, uint32 type_index, char *error_buf,
error_buf_size)) { error_buf_size)) {
return false; return false;
} }
if (module->types[type_index]->type_flag != WASM_TYPE_ARRAY) { if (module->types[type_index] == NULL
|| module->types[type_index]->type_flag != WASM_TYPE_ARRAY) {
set_error_buf(error_buf, error_buf_size, "unknown array type"); set_error_buf(error_buf, error_buf_size, "unknown array type");
return false; return false;
} }
@ -423,7 +424,8 @@ check_function_type(const WASMModule *module, uint32 type_index,
} }
#if WASM_ENABLE_GC != 0 #if WASM_ENABLE_GC != 0
if (module->types[type_index]->type_flag != WASM_TYPE_FUNC) { if (module->types[type_index] == NULL
|| module->types[type_index]->type_flag != WASM_TYPE_FUNC) {
set_error_buf(error_buf, error_buf_size, "unknown function type"); set_error_buf(error_buf, error_buf_size, "unknown function type");
return false; return false;
} }
@ -1255,8 +1257,9 @@ load_init_expr(WASMModule *module, const uint8 **p_buf, const uint8 *buf_end,
error_buf_size)) { error_buf_size)) {
goto fail; goto fail;
} }
if (module->types[type_idx]->type_flag if (module->types[type_idx] == NULL
!= WASM_TYPE_STRUCT) { || module->types[type_idx]->type_flag
!= WASM_TYPE_STRUCT) {
set_error_buf(error_buf, error_buf_size, set_error_buf(error_buf, error_buf_size,
"unknown struct type"); "unknown struct type");
goto fail; goto fail;
@ -2303,9 +2306,14 @@ load_type_section(const uint8 *buf, const uint8 *buf_end, WASMModule *module,
total_size = new_total_size; total_size = new_total_size;
} }
LOG_VERBOSE("Processing rec group [%d-%d]", if (rec_count < 1) {
processed_type_count, LOG_VERBOSE("Processing 0-entry rec group");
processed_type_count + rec_count - 1); }
else {
LOG_VERBOSE("Processing rec group [%d-%d]",
processed_type_count,
processed_type_count + rec_count - 1);
}
} }
else { else {
p--; p--;
@ -12677,7 +12685,9 @@ re_scan:
error_buf, error_buf_size)) { error_buf, error_buf_size)) {
goto fail; goto fail;
} }
if (module->types[type_idx1]->type_flag != WASM_TYPE_FUNC) { if (module->types[type_idx1] == NULL
|| module->types[type_idx1]->type_flag
!= WASM_TYPE_FUNC) {
set_error_buf(error_buf, error_buf_size, set_error_buf(error_buf, error_buf_size,
"unknown function type"); "unknown function type");
goto fail; goto fail;
@ -12694,7 +12704,9 @@ re_scan:
error_buf, error_buf_size)) { error_buf, error_buf_size)) {
goto fail; goto fail;
} }
if (module->types[type_idx]->type_flag != WASM_TYPE_FUNC) { if (module->types[type_idx] == NULL
|| module->types[type_idx]->type_flag
!= WASM_TYPE_FUNC) {
set_error_buf(error_buf, error_buf_size, set_error_buf(error_buf, error_buf_size,
"unknown function type"); "unknown function type");
goto fail; goto fail;
@ -14533,8 +14545,9 @@ re_scan:
error_buf_size)) { error_buf_size)) {
goto fail; goto fail;
} }
if (module->types[type_idx]->type_flag if (module->types[type_idx] == NULL
!= WASM_TYPE_STRUCT) { || module->types[type_idx]->type_flag
!= WASM_TYPE_STRUCT) {
set_error_buf(error_buf, error_buf_size, set_error_buf(error_buf, error_buf_size,
"unknown struct type"); "unknown struct type");
goto fail; goto fail;
@ -14620,8 +14633,9 @@ re_scan:
error_buf_size)) { error_buf_size)) {
goto fail; goto fail;
} }
if (module->types[type_idx]->type_flag if (module->types[type_idx] == NULL
!= WASM_TYPE_STRUCT) { || module->types[type_idx]->type_flag
!= WASM_TYPE_STRUCT) {
set_error_buf(error_buf, error_buf_size, set_error_buf(error_buf, error_buf_size,
"unknown struct type"); "unknown struct type");
goto fail; goto fail;