Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix memory.grow bounds and overflow checks for mem64 #7112

Merged
merged 3 commits into from
Nov 25, 2024
Merged

Fix memory.grow bounds and overflow checks for mem64 #7112

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
640a101
Fix memory.grow bounds and overflow checks for mem64
tlively Nov 25, 2024
1056129
Merge branch 'main' into mem-grow-i64-checks
tlively Nov 25, 2024
988b037
std::numeric_limits
tlively Nov 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions src/wasm-interpreter.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3836,10 +3836,14 @@ class ModuleRunnerBase : public ExpressionRunner<SubType> {
auto fail = Literal::makeFromInt64(-1, memory->addressType);
Flow ret = Literal::makeFromInt64(memorySize, addressType);
uint64_t delta = flow.getSingleValue().getUnsigned();
if (delta > uint32_t(-1) / Memory::kPageSize && addressType == Type::i32) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Strange there wan't event a TODO here!

uint64_t maxAddr =
addressType == Type::i32 ? uint64_t(uint32_t(-1)) : uint64_t(-1);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use UINT64_MAX and UINT32_MAX here?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We use std::numeric_limits<int32_t>::min() etc. in other places.

Copy link
Member

@sbc100 sbc100 Nov 25, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yuck, that is so much harder to read than UINT32_MAX, no?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Heh, I don't feel strongly. I guess it is more C++ey and can support all types and all bounds. But I wouldn't object to switching.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I get that binaryen is fully in on all the C++ things :) So lgtm either way, I just wish C++ wasn't so verbose sometimes.

if (delta > maxAddr / Memory::kPageSize) {
// Impossible to grow this much.
return fail;
}
if (memorySize >= uint32_t(-1) - delta && addressType == Type::i32) {
if (memorySize >= maxAddr - delta) {
// Overflow.
return fail;
}
auto newSize = memorySize + delta;
Expand Down
12 changes: 12 additions & 0 deletions test/lit/exec/memory64.wast
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,12 +28,24 @@
(i32.const 10)
)
)

;; CHECK: [fuzz-exec] calling memory.grow.fail
;; CHECK-NEXT: [fuzz-exec] note result: memory.grow.fail => -1
(func $memory.grow.fail (export "memory.grow.fail") (result i64)
(memory.grow
(i64.const -1)
)
)
)

;; CHECK: [fuzz-exec] calling memory.init.trap
;; CHECK-NEXT: [trap out of bounds segment access in memory.init]

;; CHECK: [fuzz-exec] calling memory.init.trap2
;; CHECK-NEXT: [trap out of bounds segment access in memory.init]

;; CHECK: [fuzz-exec] calling memory.grow.fail
;; CHECK-NEXT: [fuzz-exec] note result: memory.grow.fail => -1
;; CHECK-NEXT: [fuzz-exec] comparing memory.grow.fail
;; CHECK-NEXT: [fuzz-exec] comparing memory.init.trap
;; CHECK-NEXT: [fuzz-exec] comparing memory.init.trap2