WebAssembly / WebAssembly/wabt

SEGV in wabt::Module::operator=

Open
#2,445 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
8.1k
Forks
827
Avg merge
4d 6h
Merged PRs (30d)
18

Description

GIT revision: ed1ce97e
Built with USE_ASAN=ON
Run: ./build/wat2wasm test.wat
Test:

(module quote "\7c")

Backtrace:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==1100246==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f5a434be881 bp 0x7ffcc43aba80 sp 0x7ffcc43ab238 T0)
==1100246==The signal is caused by a READ memory access.
==1100246==Hint: address points to the zero page.
    #0 0x7f5a434be881 in memcpy string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:222
    #1 0x55ab4a3b93c4 in __asan_memcpy (wabt/bin/wat2wasm+0x1823c4) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)
    #2 0x55ab4a5467b5 in wabt::Module::operator=(wabt::Module&&) (wabt/bin/wat2wasm+0x30f7b5) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)
    #3 0x55ab4a508c3c in wabt::WastParser::ParseModuleCommand(wabt::Script*, std::unique_ptr<wabt::Command, std::default_delete<wabt::Command>>*) (wabt/bin/wat2wasm+0x2d1c3c) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)
    #4 0x55ab4a506fdc in wabt::WastParser::ParseModule(std::unique_ptr<wabt::Module, std::default_delete<wabt::Module>>*) (wabt/bin/wat2wasm+0x2cffdc) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)
    #5 0x55ab4a53d611 in wabt::ParseWatModule(wabt::WastLexer*, std::unique_ptr<wabt::Module, std::default_delete<wabt::Module>>*, std::vector<wabt::Error, std::allocator<wabt::Error>>*, wabt::WastParseOptions*) (wabt/bin/wat2wasm+0x306611) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)
    #6 0x55ab4a3fa8f9 in ProgramMain(int, char**) (wabt/bin/wat2wasm+0x1c38f9) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)
    #7 0x55ab4a3fc2c1 in main (wabt/bin/wat2wasm+0x1c52c1) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)
    #8 0x7f5a43423d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #9 0x7f5a43423e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #10 0x55ab4a31f194 in _start (wabt/bin/wat2wasm+0xe8194) (BuildId: a5f593cb6819aa12ce15795bdae38dd1e63c168d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:222 in memcpy
==1100246==ABORTING

The issue was found by libFuzzer with a Grammarinator-based custom mutator.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Run ./build/wat2wasm test.wat with the shown module input under USE_ASAN=ON, then inspect wabt::Module::operator= and the WastParser::ParseModuleCommand path from the backtrace. The fix is done when this input no longer triggers the SEGV and equivalent regression coverage passes under ASAN.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, wasm
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.