mirror of
https://github.com/RGBCube/serenity
synced 2025-07-26 02:57:36 +00:00
LibWasm: Fix data section initialization bounds checking
This commit is contained in:
parent
d2212a1f51
commit
03fe50d5e7
1 changed files with 12 additions and 4 deletions
|
@ -280,14 +280,22 @@ InstantiationResult AbstractMachine::instantiate(Module const& module, Vector<Ex
|
||||||
if (instantiation_result.has_value() && instantiation_result->is_error())
|
if (instantiation_result.has_value() && instantiation_result->is_error())
|
||||||
return;
|
return;
|
||||||
if (main_module_instance.memories().size() <= data.index.value()) {
|
if (main_module_instance.memories().size() <= data.index.value()) {
|
||||||
instantiation_result = InstantiationError { String::formatted("Data segment referenced out-of-bounds memory ({}) of max {} entries", data.index.value(), main_module_instance.memories().size()) };
|
instantiation_result = InstantiationError {
|
||||||
|
String::formatted("Data segment referenced out-of-bounds memory ({}) of max {} entries",
|
||||||
|
data.index.value(), main_module_instance.memories().size())
|
||||||
|
};
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
auto address = main_module_instance.memories()[data.index.value()];
|
auto address = main_module_instance.memories()[data.index.value()];
|
||||||
if (auto instance = m_store.get(address)) {
|
if (auto instance = m_store.get(address)) {
|
||||||
if (instance->type().limits().max().value_or(data.init.size() + offset + 1) <= data.init.size() + offset) {
|
if (auto max = instance->type().limits().max(); max.has_value()) {
|
||||||
instantiation_result = InstantiationError { String::formatted("Data segment attempted to write to out-of-bounds memory ({}) of max {} bytes", data.init.size() + offset, instance->type().limits().max().value()) };
|
if (*max < data.init.size() + offset) {
|
||||||
return;
|
instantiation_result = InstantiationError {
|
||||||
|
String::formatted("Data segment attempted to write to out-of-bounds memory ({}) of max {} bytes",
|
||||||
|
data.init.size() + offset, instance->type().limits().max().value())
|
||||||
|
};
|
||||||
|
return;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
if (instance->size() < data.init.size() + offset)
|
if (instance->size() < data.init.size() + offset)
|
||||||
instance->grow(data.init.size() + offset - instance->size());
|
instance->grow(data.init.size() + offset - instance->size());
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue