Skip to content

Conversation

@kripken
Copy link
Member

@kripken kripken commented Jun 17, 2024

The code used i instead of index, as in this pseudocode:

for i in range(num_names):
  index = readU32LEB() # index of the data segment to name
  name = readName()    # name to give that segment
  data[i] = name       # XXX 'i' should be 'index'

That (funnily enough) happened to always work before since we write names in
order. That is, normally given segments A,B,C we'd write then in the names section
as A,B,C. Then the reader, which had the bug, would always have i and index
identical in value anyhow. But if a wasm producer used different indexes, a
problem could happen.

To test this, add a binary file that has a reversed name section.

Fixes #6672

@kripken kripken merged commit b377b6f into WebAssembly:main Jun 17, 2024
@kripken kripken deleted the data.names.order branch June 17, 2024 22:21
@gkdn gkdn mentioned this pull request Aug 31, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SegFault/out of bounds data in wasm::WasmBinaryReader::readNames

2 participants