Skip to content

Commit c19bc95

Browse files
lum1n0uslum1n0us
authored
Validate func type in aot loader (#3535)
Fix issue reported by Oss-fuzz test (#69629).
1 parent f096b2f commit c19bc95

File tree

5 files changed

+66
-46
lines changed

5 files changed

+66
-46
lines changed

‎core/iwasm/aot/aot_loader.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1684,6 +1684,9 @@ load_types(const uint8 **p_buf, const uint8 *buf_end, AOTModule *module,
16841684

16851685
func_type->ref_type_map_count = ref_type_map_count;
16861686

1687+
if (!is_valid_func_type(func_type))
1688+
goto fail;
1689+
16871690
param_cell_num = wasm_get_cell_num(func_type->types, param_count);
16881691
ret_cell_num =
16891692
wasm_get_cell_num(func_type->types + param_count, result_count);
@@ -1988,6 +1991,9 @@ load_types(const uint8 **p_buf, const uint8 *buf_end, AOTModule *module,
19881991
func_types[i]->result_count = (uint16)result_count;
19891992
read_byte_array(buf, buf_end, func_types[i]->types, (uint32)size1);
19901993

1994+
if (!is_valid_func_type(func_types[i]))
1995+
goto fail;
1996+
19911997
param_cell_num = wasm_get_cell_num(func_types[i]->types, param_count);
19921998
ret_cell_num =
19931999
wasm_get_cell_num(func_types[i]->types + param_count, result_count);

‎core/iwasm/common/wasm_loader_common.c

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,9 @@
44
*/
55
#include "wasm_loader_common.h"
66
#include "bh_log.h"
7-
#include "../interpreter/wasm.h"
7+
#if WASM_ENABLE_GC != 0
8+
#include "../common/gc/gc_type.h"
9+
#endif
810

911
static void
1012
set_error_buf(char *error_buf, uint32 error_buf_size, const char *string,
@@ -56,3 +58,41 @@ wasm_memory_check_flags(const uint8 mem_flag, char *error_buf,
5658

5759
return true;
5860
}
61+
62+
/*
63+
* compare with a bigger type set in `wasm_value_type_size_internal()`,
64+
* this function will only cover global value type, function's param
65+
* value type and function's result value type.
66+
*
67+
* please feel free to add more if there are more requirements
68+
*/
69+
bool
70+
is_valid_value_type(uint8 type)
71+
{
72+
if (/* I32/I64/F32/F64, 0x7C to 0x7F */
73+
(type >= VALUE_TYPE_F64 && type <= VALUE_TYPE_I32)
74+
#if WASM_ENABLE_GC != 0
75+
/* reference types, 0x65 to 0x70 */
76+
|| wasm_is_type_reftype(type)
77+
#elif WASM_ENABLE_REF_TYPES != 0
78+
|| (type == VALUE_TYPE_FUNCREF || type == VALUE_TYPE_EXTERNREF)
79+
#endif
80+
#if WASM_ENABLE_SIMD != 0
81+
|| type == VALUE_TYPE_V128 /* 0x7B */
82+
#endif
83+
)
84+
return true;
85+
return false;
86+
}
87+
88+
bool
89+
is_valid_func_type(const WASMFuncType *func_type)
90+
{
91+
unsigned i;
92+
for (i = 0; i < func_type->param_count + func_type->result_count; i++) {
93+
if (!is_valid_value_type(func_type->types[i]))
94+
return false;
95+
}
96+
97+
return true;
98+
}

‎core/iwasm/common/wasm_loader_common.h

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
#define _WASM_LOADER_COMMON_H
88

99
#include "platform_common.h"
10+
#include "../interpreter/wasm.h"
1011

1112
#ifdef __cplusplus
1213
extern "C" {
@@ -16,6 +17,12 @@ bool
1617
wasm_memory_check_flags(const uint8 mem_flag, char *error_buf,
1718
uint32 error_buf_size, bool is_aot);
1819

20+
bool
21+
is_valid_value_type(uint8 value_tpye);
22+
23+
bool
24+
is_valid_func_type(const WASMFuncType *func_type);
25+
1926
#ifdef __cplusplus
2027
}
2128
#endif

‎core/iwasm/interpreter/wasm_loader.c

Lines changed: 8 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -323,27 +323,6 @@ is_64bit_type(uint8 type)
323323
return false;
324324
}
325325

326-
static bool
327-
is_value_type(uint8 type)
328-
{
329-
if (/* I32/I64/F32/F64, 0x7C to 0x7F */
330-
(type >= VALUE_TYPE_F64 && type <= VALUE_TYPE_I32)
331-
#if WASM_ENABLE_GC != 0
332-
/* reference types, 0x65 to 0x70 */
333-
|| wasm_is_type_reftype(type)
334-
#elif WASM_ENABLE_REF_TYPES != 0
335-
|| (type == VALUE_TYPE_FUNCREF || type == VALUE_TYPE_EXTERNREF)
336-
#endif
337-
#if WASM_ENABLE_SIMD != 0
338-
#if (WASM_ENABLE_WAMR_COMPILER != 0) || (WASM_ENABLE_JIT != 0)
339-
|| type == VALUE_TYPE_V128 /* 0x7B */
340-
#endif
341-
#endif
342-
)
343-
return true;
344-
return false;
345-
}
346-
347326
#if WASM_ENABLE_GC != 0
348327
static bool
349328
is_packed_type(uint8 type)
@@ -355,7 +334,8 @@ is_packed_type(uint8 type)
355334
static bool
356335
is_byte_a_type(uint8 type)
357336
{
358-
return (is_value_type(type) || (type == VALUE_TYPE_VOID)) ? true : false;
337+
return (is_valid_value_type(type) || (type == VALUE_TYPE_VOID)) ? true
338+
: false;
359339
}
360340

361341
#if WASM_ENABLE_SIMD != 0
@@ -1462,7 +1442,7 @@ resolve_value_type(const uint8 **p_buf, const uint8 *buf_end,
14621442
}
14631443
else {
14641444
/* type which can be represented by one byte */
1465-
if (!is_value_type(type)
1445+
if (!is_valid_value_type(type)
14661446
&& !(allow_packed_type && is_packed_type(type))) {
14671447
set_error_buf(error_buf, error_buf_size, "type mismatch");
14681448
return false;
@@ -1972,7 +1952,7 @@ load_type_section(const uint8 *buf, const uint8 *buf_end, WASMModule *module,
19721952
type->types[param_count + j] = read_uint8(p);
19731953
}
19741954
for (j = 0; j < param_count + result_count; j++) {
1975-
if (!is_value_type(type->types[j])) {
1955+
if (!is_valid_value_type(type->types[j])) {
19761956
set_error_buf(error_buf, error_buf_size,
19771957
"unknown value type");
19781958
return false;
@@ -3061,7 +3041,7 @@ load_global_import(const uint8 **p_buf, const uint8 *buf_end,
30613041
CHECK_BUF(p, p_end, 2);
30623042
/* global type */
30633043
declare_type = read_uint8(p);
3064-
if (!is_value_type(declare_type)) {
3044+
if (!is_valid_value_type(declare_type)) {
30653045
set_error_buf(error_buf, error_buf_size, "type mismatch");
30663046
return false;
30673047
}
@@ -3773,7 +3753,7 @@ load_function_section(const uint8 *buf, const uint8 *buf_end,
37733753
CHECK_BUF(p_code, buf_code_end, 1);
37743754
/* 0x7F/0x7E/0x7D/0x7C */
37753755
type = read_uint8(p_code);
3776-
if (!is_value_type(type)) {
3756+
if (!is_valid_value_type(type)) {
37773757
if (type == VALUE_TYPE_V128)
37783758
set_error_buf(error_buf, error_buf_size,
37793759
"v128 value type requires simd feature");
@@ -4048,7 +4028,7 @@ load_global_section(const uint8 *buf, const uint8 *buf_end, WASMModule *module,
40484028
CHECK_BUF(p, p_end, 2);
40494029
/* global type */
40504030
global->type.val_type = read_uint8(p);
4051-
if (!is_value_type(global->type.val_type)) {
4031+
if (!is_valid_value_type(global->type.val_type)) {
40524032
set_error_buf(error_buf, error_buf_size, "type mismatch");
40534033
return false;
40544034
}
@@ -12322,7 +12302,7 @@ wasm_loader_prepare_bytecode(WASMModule *module, WASMFunction *func,
1232212302
#if WASM_ENABLE_GC == 0
1232312303
CHECK_BUF(p, p_end, 1);
1232412304
type = read_uint8(p);
12325-
if (!is_value_type(type)) {
12305+
if (!is_valid_value_type(type)) {
1232612306
set_error_buf(error_buf, error_buf_size,
1232712307
"unknown value type");
1232812308
goto fail;

‎core/iwasm/interpreter/wasm_mini_loader.c

Lines changed: 4 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -88,23 +88,10 @@ is_64bit_type(uint8 type)
8888
return false;
8989
}
9090

91-
static bool
92-
is_value_type(uint8 type)
93-
{
94-
if (type == VALUE_TYPE_I32 || type == VALUE_TYPE_I64
95-
|| type == VALUE_TYPE_F32 || type == VALUE_TYPE_F64
96-
#if WASM_ENABLE_REF_TYPES != 0
97-
|| type == VALUE_TYPE_FUNCREF || type == VALUE_TYPE_EXTERNREF
98-
#endif
99-
)
100-
return true;
101-
return false;
102-
}
103-
10491
static bool
10592
is_byte_a_type(uint8 type)
10693
{
107-
return is_value_type(type) || (type == VALUE_TYPE_VOID);
94+
return is_valid_value_type(type) || (type == VALUE_TYPE_VOID);
10895
}
10996

11097
static void
@@ -581,7 +568,7 @@ load_type_section(const uint8 *buf, const uint8 *buf_end, WASMModule *module,
581568
type->types[param_count + j] = read_uint8(p);
582569
}
583570
for (j = 0; j < param_count + result_count; j++) {
584-
bh_assert(is_value_type(type->types[j]));
571+
bh_assert(is_valid_value_type(type->types[j]));
585572
}
586573

587574
param_cell_num = wasm_get_cell_num(type->types, param_count);
@@ -1228,7 +1215,7 @@ load_function_section(const uint8 *buf, const uint8 *buf_end,
12281215
CHECK_BUF(p_code, buf_code_end, 1);
12291216
/* 0x7F/0x7E/0x7D/0x7C */
12301217
type = read_uint8(p_code);
1231-
bh_assert(is_value_type(type));
1218+
bh_assert(is_valid_value_type(type));
12321219
for (k = 0; k < sub_local_count; k++) {
12331220
func->local_types[local_type_index++] = type;
12341221
}
@@ -6829,7 +6816,7 @@ wasm_loader_prepare_bytecode(WASMModule *module, WASMFunction *func,
68296816

68306817
CHECK_BUF(p, p_end, 1);
68316818
ref_type = read_uint8(p);
6832-
if (!is_value_type(ref_type)) {
6819+
if (!is_valid_value_type(ref_type)) {
68336820
set_error_buf(error_buf, error_buf_size,
68346821
"unknown value type");
68356822
goto fail;

0 commit comments

Comments
 (0)