WebAssembly / WebAssembly/wabt
SEGV in wabt::Module::operator=
Open
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 8.1k
- Forks
- 827
- Avg merge
- 4d 6h
- Merged PRs (30d)
- 18
Description
GIT revision: ed1ce97e
Built with USE_ASAN=ON
Run: ./build/wat2wasm test.wat
Test:
(module quote "\7c")
Backtrace:
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1100246==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f5a434be881 bp 0x7ffcc43aba80 sp 0x7ffcc43ab238 T0)
==1100246==The signal is caused by a READ memory access.
==1100246==Hint: address points to the zero page.
#0 0x7f5a434be881 in memcpy string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:222
#1 0x55ab4a3b93c4 in __asan_memcpy (wabt/bin/wat2wasm+0x1823c4) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)
#2 0x55ab4a5467b5 in wabt::Module::operator=(wabt::Module&&) (wabt/bin/wat2wasm+0x30f7b5) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)
#3 0x55ab4a508c3c in wabt::WastParser::ParseModuleCommand(wabt::Script*, std::unique_ptr<wabt::Command, std::default_delete<wabt::Command>>*) (wabt/bin/wat2wasm+0x2d1c3c) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)
#4 0x55ab4a506fdc in wabt::WastParser::ParseModule(std::unique_ptr<wabt::Module, std::default_delete<wabt::Module>>*) (wabt/bin/wat2wasm+0x2cffdc) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)
#5 0x55ab4a53d611 in wabt::ParseWatModule(wabt::WastLexer*, std::unique_ptr<wabt::Module, std::default_delete<wabt::Module>>*, std::vector<wabt::Error, std::allocator<wabt::Error>>*, wabt::WastParseOptions*) (wabt/bin/wat2wasm+0x306611) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)
#6 0x55ab4a3fa8f9 in ProgramMain(int, char**) (wabt/bin/wat2wasm+0x1c38f9) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)
#7 0x55ab4a3fc2c1 in main (wabt/bin/wat2wasm+0x1c52c1) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)
#8 0x7f5a43423d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#9 0x7f5a43423e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#10 0x55ab4a31f194 in _start (wabt/bin/wat2wasm+0xe8194) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:222 in memcpy
==1100246==ABORTING
The issue was found by libFuzzer with a Grammarinator-based custom mutator.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Run ./build/wat2wasm test.wat with the shown module input under USE_ASAN=ON, then inspect wabt::Module::operator= and the WastParser::ParseModuleCommand path from the backtrace. The fix is done when this input no longer triggers the SEGV and equivalent regression coverage passes under ASAN.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, wasm
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100