Skip to content

Commit 1fc0be7

Browse files
fix: fix unchecked memory offsets causing issues on 32 bit
Signed-off-by: Henry <mail@henrygressmann.de>
1 parent 2c34997 commit 1fc0be7

1 file changed

Lines changed: 24 additions & 4 deletions

File tree

crates/tinywasm/src/interpreter/executor.rs

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ use alloc::{rc::Rc, string::ToString};
88
use interpreter::stack::CallFrame;
99
use tinywasm_types::*;
1010

11-
use super::ExecState;
1211
use super::num_helpers::*;
1312
use super::values::*;
13+
use super::ExecState;
1414
use crate::engine::FuelPolicy;
1515
use crate::instance::ModuleInstanceInner;
1616
use crate::interpreter::Value128;
@@ -854,7 +854,13 @@ impl<'store, const BUDGETED: bool> Executor<'store, BUDGETED> {
854854
let mem = self.store.state.get_mem_mut(self.module.resolve_mem_addr(memarg.mem_addr()));
855855
let addr = u64::from(self.store.stack.values.local_get::<u32>(&self.cf, u16::from(addr_local)));
856856
let value = cast(self.store.stack.values.local_get::<T>(&self.cf, u16::from(value_local))).to_mem_bytes();
857-
mem.store((memarg.offset() + addr) as usize, value.len(), &value)?;
857+
let Some(effective_addr) = memarg.offset().checked_add(addr) else {
858+
return Err(Error::Trap(Trap::MemoryOutOfBounds { offset: addr as usize, len: N, max: 0 }));
859+
};
860+
let Ok(effective_addr) = usize::try_from(effective_addr) else {
861+
return Err(Error::Trap(Trap::MemoryOutOfBounds { offset: addr as usize, len: N, max: 0 }));
862+
};
863+
mem.store(effective_addr, value.len(), &value)?;
858864
Ok(())
859865
}
860866

@@ -1067,7 +1073,14 @@ impl<'store, const BUDGETED: bool> Executor<'store, BUDGETED> {
10671073
false => self.store.stack.values.pop::<i32>() as u32 as u64,
10681074
};
10691075

1070-
mem.store((offset + addr) as usize, val.len(), &val)?;
1076+
let Some(effective_addr) = offset.checked_add(addr) else {
1077+
return Err(Error::Trap(Trap::MemoryOutOfBounds { offset: addr as usize, len: N, max: 0 }));
1078+
};
1079+
let Ok(effective_addr) = usize::try_from(effective_addr) else {
1080+
return Err(Error::Trap(Trap::MemoryOutOfBounds { offset: addr as usize, len: N, max: 0 }));
1081+
};
1082+
1083+
mem.store(effective_addr, val.len(), &val)?;
10711084

10721085
Ok(())
10731086
}
@@ -1087,7 +1100,14 @@ impl<'store, const BUDGETED: bool> Executor<'store, BUDGETED> {
10871100
false => u64::from(self.store.stack.values.pop::<i32>() as u32),
10881101
};
10891102

1090-
mem.store((offset + addr) as usize, val.len(), &val)?;
1103+
let Some(effective_addr) = offset.checked_add(addr) else {
1104+
return Err(Error::Trap(Trap::MemoryOutOfBounds { offset: addr as usize, len: N, max: 0 }));
1105+
};
1106+
let Ok(effective_addr) = usize::try_from(effective_addr) else {
1107+
return Err(Error::Trap(Trap::MemoryOutOfBounds { offset: addr as usize, len: N, max: 0 }));
1108+
};
1109+
1110+
mem.store(effective_addr, val.len(), &val)?;
10911111

10921112
Ok(())
10931113
}

0 commit comments

Comments
 (0)