T0b1/wasmtime
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix an issue where massive memory images are created (#4112)

Browse Source 
This commit fixes an issue introduced in #4046 where the checks for
ensuring that the memory initialization image for a module was
constrained in its size failed to trigger and a very small module could
produce an arbitrarily large memory image.

The bug in question was that if a module only had empty data segments at
arbitrarily small and large addresses then the loop which checks whether
or not the image is allowed was skipped entirely since it was seen that
the memory had no data size. The fix here is to skip segments that are
empty to ensure that if the validation loop is skipped then no data
segments will be processed to create the image (and the module won't end
up having an image in the end).
This commit is contained in:
Alex Crichton
2022-05-09 11:04:56 -05:00
committed by GitHub
parent b525661d2f
commit ccf834b473
2 changed files with 64 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
crates/environ/src/module.rs
View File

@@ -252,10 +252,12 @@ impl ModuleTranslation<'_> {
};
let info = &mut info[memory];
let data_len = u64::from(init.data.end - init.data.start);
info.data_size += data_len;
info.min_addr = info.min_addr.min(init.offset);
info.max_addr = info.max_addr.max(init.offset + data_len);
info.segments.push((idx, init.clone()));
if data_len > 0 {
info.data_size += data_len;
info.min_addr = info.min_addr.min(init.offset);
info.max_addr = info.max_addr.max(init.offset + data_len);
info.segments.push((idx, init.clone()));
}
idx += 1;
true
},