Просмотр исходного кода

fast-interp: Fix frame_offset overflow issue (#3149)

The issue was found in https://github.com/bytecodealliance/wasm-micro-runtime/issues/3137.
Xu Jun 1 год назад
Родитель
Сommit
12f834aebd
2 измененных файлов с 18 добавлено и 4 удалено
  1. 9 2
      core/iwasm/interpreter/wasm_loader.c
  2. 9 2
      core/iwasm/interpreter/wasm_mini_loader.c

+ 9 - 2
core/iwasm/interpreter/wasm_loader.c

@@ -10796,8 +10796,15 @@ re_scan:
                              * Since the stack is already in polymorphic state,
                              * the opcode will not be executed, so the dummy
                              * offset won't cause any error */
-                            *loader_ctx->frame_offset++ = 0;
-                            if (cell_num > 1) {
+                            uint32 n;
+
+                            for (n = 0; n < cell_num; n++) {
+                                if (loader_ctx->p_code_compiled == NULL) {
+                                    if (!check_offset_push(loader_ctx,
+                                                           error_buf,
+                                                           error_buf_size))
+                                        goto fail;
+                                }
                                 *loader_ctx->frame_offset++ = 0;
                             }
                         }

+ 9 - 2
core/iwasm/interpreter/wasm_mini_loader.c

@@ -5931,8 +5931,15 @@ re_scan:
                              * Since the stack is already in polymorphic state,
                              * the opcode will not be executed, so the dummy
                              * offset won't cause any error */
-                            *loader_ctx->frame_offset++ = 0;
-                            if (cell_num > 1) {
+                            uint32 n;
+
+                            for (n = 0; n < cell_num; n++) {
+                                if (loader_ctx->p_code_compiled == NULL) {
+                                    if (!check_offset_push(loader_ctx,
+                                                           error_buf,
+                                                           error_buf_size))
+                                        goto fail;
+                                }
                                 *loader_ctx->frame_offset++ = 0;
                             }
                         }