bytecodealliance / bytecodealliance/wasm-tools

Fuzz test a 32-bit build

Open
#10 0 comments 0 reactions 0 assignees View on GitHub
wasmparser
Dominant language
Rust
Stars
1.8k
Forks
351
Avg merge
16h 57m
Merged PRs (30d)
38

Description

In the `read_function_body()` function, the code reading the local variable declarations looks like this:

```rust
for _ in 0..local_count {
let (count, ty) = self.reader.read_local_decl()?;
locals_total += count as usize;
if locals_total > MAX_WASM_FUNCTION_LOCALS {
return Err(BinaryReaderError {
message: "local_count is out of bounds",
offset: self.reader.position - 1,
});
}
locals.push((count, ty));
}
```

In a 32-bit build, the addition in `locals_total += count as usize` could overflow which causes a panic only in debug builds. In release builds it silently wraps.

A fuzz tester running on a 32-bit build would probably catch that.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.