bytecodealliance / bytecodealliance/wasmtime

Consider adding an engine assertion to `Module::wasm_to_array_trampoline`

Open
#14,046 0 comments 0 reactions 0 assignees View on GitHub
cleanup
Dominant language
Rust
Stars
18.6k
Forks
1.8k
Avg merge
1d 19h
Merged PRs (30d)
121

Description

This is a follow-up to https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 and https://github.com/bytecodealliance/wasmtime/pull/14044 which wasn't originally included in the fix for the advisory due to complexity needed. The idea though is that it might be reasonable to have a defensive assertion in `Module::wasm_to_array_trampoline` to assert that the engine which the `VMSharedTypeIndex` comes from is indeed the same engine as the `Module` itself.

@fitzgen one possible idea I just had from the original implementation you had was that we could perhaps store an "Engine ID" inside of a `ModuleRegistry` to avoid threading `&Engine` to a whole bunch of new places if that causes problems. That'd be easier than storing the entire engine itself in there.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.