LadybirdBrowser/ladybird
1
1
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-08-17 01:10:28 +03:00
Code Issues Packages Projects Releases Wiki Activity

LibWasm: Properly check table bounds in element instantiation

Browse Source 
Offset is now checked using saturating addition to avoid overflow. This
prevents a crash in the VM during instantiation.
This commit is contained in:
Diego 2024-06-01 13:16:49 -07:00 committed by Ali Mohammad Pur
parent 2fabbae0f6
commit 308592969c
Notes: sideshowbarker 2024-07-17 18:08:55 +09:00 
Author: https://github.com/dzfrias
Commit: https://github.com/SerenityOS/serenity/commit/308592969c
Pull-request: https://github.com/SerenityOS/serenity/pull/24517
1 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Userland/Libraries/LibWasm/AbstractMachine/AbstractMachine.cpp
View File

@ -282,16 +282,14 @@ InstantiationResult AbstractMachine::instantiate(Module const& module, Vector<Ex
return IterationDecision::Break;
}
auto total_required_size = elem_instance->references().size() + d.value();
Checked<size_t> total_size = elem_instance->references().size();
total_size.saturating_add(d.value());
if (table_instance->type().limits().max().value_or(total_required_size) < total_required_size) {
instantiation_result = InstantiationError { "Table limit overflow in active element segment" };
if (total_size.value() > table_instance->elements().size()) {
instantiation_result = InstantiationError { "Table instantiation out of bounds" };
return IterationDecision::Break;
}
if (table_instance->elements().size() < total_required_size)
table_instance->elements().resize(total_required_size);
size_t i = 0;
for (auto it = elem_instance->references().begin(); it < elem_instance->references().end(); ++i, ++it) {
table_instance->elements()[i + d.value()] = *it;