bytecodealliance / bytecodealliance/wasm-tools
Fuzz test a 32-bit build
- Dominant language
- Rust
- Stars
- 1.8k
- Forks
- 351
- Avg merge
- 16h 57m
- Merged PRs (30d)
- 38
Description
In the `read_function_body()` function, the code reading the local variable declarations looks like this:
```rust
for _ in 0..local_count {
let (count, ty) = self.reader.read_local_decl()?;
locals_total += count as usize;
if locals_total > MAX_WASM_FUNCTION_LOCALS {
return Err(BinaryReaderError {
message: "local_count is out of bounds",
offset: self.reader.position - 1,
});
}
locals.push((count, ty));
}
```
In a 32-bit build, the addition in `locals_total += count as usize` could overflow which causes a panic only in debug builds. In release builds it silently wraps.
A fuzz tester running on a 32-bit build would probably catch that.
Contributor guide
Assessment
This issue has not been assessed yet.