Add fast interpreter offset overflow check (#1076)
* check fast interpreter offset overflow
This commit is contained in:
parent
ea63ba4bd0
commit
fd9cce0eef
@ -5317,8 +5317,12 @@ wasm_loader_push_frame_offset(WASMLoaderContext *ctx, uint8 type,
|
|||||||
emit_operand(ctx, ctx->dynamic_offset);
|
emit_operand(ctx, ctx->dynamic_offset);
|
||||||
*(ctx->frame_offset)++ = ctx->dynamic_offset;
|
*(ctx->frame_offset)++ = ctx->dynamic_offset;
|
||||||
ctx->dynamic_offset++;
|
ctx->dynamic_offset++;
|
||||||
if (ctx->dynamic_offset > ctx->max_dynamic_offset)
|
if (ctx->dynamic_offset > ctx->max_dynamic_offset) {
|
||||||
ctx->max_dynamic_offset = ctx->dynamic_offset;
|
ctx->max_dynamic_offset = ctx->dynamic_offset;
|
||||||
|
if (ctx->max_dynamic_offset >= INT16_MAX) {
|
||||||
|
goto fail;
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if (is_32bit_type(type))
|
if (is_32bit_type(type))
|
||||||
@ -5332,10 +5336,19 @@ wasm_loader_push_frame_offset(WASMLoaderContext *ctx, uint8 type,
|
|||||||
ctx->frame_offset++;
|
ctx->frame_offset++;
|
||||||
if (!disable_emit) {
|
if (!disable_emit) {
|
||||||
ctx->dynamic_offset++;
|
ctx->dynamic_offset++;
|
||||||
if (ctx->dynamic_offset > ctx->max_dynamic_offset)
|
if (ctx->dynamic_offset > ctx->max_dynamic_offset) {
|
||||||
ctx->max_dynamic_offset = ctx->dynamic_offset;
|
ctx->max_dynamic_offset = ctx->dynamic_offset;
|
||||||
|
if (ctx->max_dynamic_offset >= INT16_MAX) {
|
||||||
|
goto fail;
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
return true;
|
return true;
|
||||||
|
|
||||||
|
fail:
|
||||||
|
set_error_buf(error_buf, error_buf_size,
|
||||||
|
"fast interpreter offset overflow");
|
||||||
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* This function should be in front of wasm_loader_pop_frame_ref
|
/* This function should be in front of wasm_loader_pop_frame_ref
|
||||||
|
@ -3844,8 +3844,10 @@ wasm_loader_push_frame_offset(WASMLoaderContext *ctx, uint8 type,
|
|||||||
emit_operand(ctx, ctx->dynamic_offset);
|
emit_operand(ctx, ctx->dynamic_offset);
|
||||||
*(ctx->frame_offset)++ = ctx->dynamic_offset;
|
*(ctx->frame_offset)++ = ctx->dynamic_offset;
|
||||||
ctx->dynamic_offset++;
|
ctx->dynamic_offset++;
|
||||||
if (ctx->dynamic_offset > ctx->max_dynamic_offset)
|
if (ctx->dynamic_offset > ctx->max_dynamic_offset) {
|
||||||
ctx->max_dynamic_offset = ctx->dynamic_offset;
|
ctx->max_dynamic_offset = ctx->dynamic_offset;
|
||||||
|
bh_assert(ctx->max_dynamic_offset < INT16_MAX);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if (is_32bit_type(type))
|
if (is_32bit_type(type))
|
||||||
@ -3859,8 +3861,10 @@ wasm_loader_push_frame_offset(WASMLoaderContext *ctx, uint8 type,
|
|||||||
ctx->frame_offset++;
|
ctx->frame_offset++;
|
||||||
if (!disable_emit) {
|
if (!disable_emit) {
|
||||||
ctx->dynamic_offset++;
|
ctx->dynamic_offset++;
|
||||||
if (ctx->dynamic_offset > ctx->max_dynamic_offset)
|
if (ctx->dynamic_offset > ctx->max_dynamic_offset) {
|
||||||
ctx->max_dynamic_offset = ctx->dynamic_offset;
|
ctx->max_dynamic_offset = ctx->dynamic_offset;
|
||||||
|
bh_assert(ctx->max_dynamic_offset < INT16_MAX);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
Reference in New Issue
Block a user