bytecodealliance / bytecodealliance/wasmtime
The implementation of `fd_filestat_get` in wasi-preview1-component-adapter is unsound
- Dominant language
- Rust
- Stars
- 18.6k
- Forks
- 1.8k
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 126
Description
The implementation uses the value of `metadataHash` as `st_ino`:
https://github.com/bytecodealliance/wasmtime/blob/225d20efe387bc3f4052ec3115125380f9c59774/crates/wasi-preview1-component-adapter/src/lib.rs#L950-L951
This is unsound. To quote the documentation for `metadataHash`:
> Return a hash of the metadata associated with a filesystem object referred to by a descriptor.
>
> This returns a hash of the last-modification timestamp and file size, and may also include the inode number, device number, birth timestamp, and other metadata fields that may change when the file is modified or replaced. It may also include a secret value chosen by the implementation and not otherwise exposed.
>
> Implementations are encourated to provide the following properties:
>
> - If the file is not modified or replaced, the computed hash value should usually not change.
> - If the object is modified or replaced, the computed hash value should usually change.
> - The inputs to the hash should not be easily computable from the computed hash.
>
> However, none of these is required.
Applications will commonly use `st1.st_ino == st2.st_ino` in order to determine if two files are the same (for example, Clang does it). My implementation of `metadataHash`, which always returns 0 and is compliant with the definition above, caused the combination of Clang and the wasip1 component adapter, to always treat all read files as the same file (which in practice meant the first `#include` caused an infinite loop).
Contributor guide
Assessment
This issue has not been assessed yet.