Explorar o código

add validation for rec indices in aot loader (#4520)

Zhenwei Jin hai 7 meses
pai
achega
33eff933c0
Modificáronse 1 ficheiros con 6 adicións e 1 borrados
  1. 6 1
      core/iwasm/aot/aot_loader.c

+ 6 - 1
core/iwasm/aot/aot_loader.c

@@ -1805,7 +1805,12 @@ load_types(const uint8 **p_buf, const uint8 *buf_end, AOTModule *module,
         read_uint32(buf, buf_end, parent_type_idx);
         read_uint16(buf, buf_end, rec_count);
         read_uint16(buf, buf_end, rec_idx);
-
+#if WASM_ENABLE_AOT_VALIDATOR != 0
+        if (rec_idx > i) {
+            set_error_buf(error_buf, error_buf_size, "invalid rec_idx");
+            goto fail;
+        }
+#endif
         if (type_flag == WASM_TYPE_FUNC) {
             AOTFuncType *func_type;