WebAssembly / WebAssembly/wabt
wasm-decompile: Assertion `!empty()' failure cause DoS
Open
Nobody has claimed this yet.
wasm-decompile
- Dominant language
- C++
- Stars
- 8.1k
- Forks
- 827
- Avg merge
- 4d 6h
- Merged PRs (30d)
- 18
Description
Environments
OS : Ubuntu 18.04 5.4.0-150-generic
Commit : e97d53c5fcbb604fc36432df4fc117d13558d7fd
Version : 1.0.34
Vulnerability Description
Affected Tool : wasm-decompile
Affected Version : <= 1.0.34
Impact : Denial of Service
- The assertion '!empty()' fail in /include/wabt/intrusive-list.h in wabt 1.0.34 can cause a denial of service(assertion failure) via a crafted wasm file.
PoC
1. Input File
2. Reproduce
$ ~/wabt/bin/wasm-decompile wasm-decompile-DOS-poc01
3. Stack Trace
$ ~/wabt/bin/wasm-decompile wasm-decompile-DOS-poc01
wasm-decompile: ../../../../include/wabt/intrusive-list.h:394: typename intrusive_list<T>::const_reference wabt::intrusive_list<wabt::Expr>::front() const [T = wabt::Expr]: Assertion `!empty()' failed.
Aborted
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure with the linked wasm-decompile PoC using the command shown, then trace the assertion in include/wabt/intrusive-list.h:394 through wasm-decompile. Identify why the crafted file reaches front() on an empty list. Done means the PoC no longer aborts with the assertion or causes the reported denial of service.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, wasm
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100