bytecodealliance / bytecodealliance/wasmtime
Consider adding an engine assertion to `Module::wasm_to_array_trampoline`
- Dominant language
- Rust
- Stars
- 18.6k
- Forks
- 1.8k
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 121
Description
This is a follow-up to https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 and https://github.com/bytecodealliance/wasmtime/pull/14044 which wasn't originally included in the fix for the advisory due to complexity needed. The idea though is that it might be reasonable to have a defensive assertion in `Module::wasm_to_array_trampoline` to assert that the engine which the `VMSharedTypeIndex` comes from is indeed the same engine as the `Module` itself.
@fitzgen one possible idea I just had from the original implementation you had was that we could perhaps store an "Engine ID" inside of a `ModuleRegistry` to avoid threading `&Engine` to a whole bunch of new places if that causes problems. That'd be easier than storing the entire engine itself in there.
Contributor guide
Assessment
This issue has not been assessed yet.