dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

LibWasm: Validate a tag's type index before dereferencing it

Browse source 
The throw and try_table validators looked up the tag referenced by the
instruction, then indexed m_context.types with the tag's type index
without checking it was in range. validate(TagIndex) only validates the
tag index itself, and the tag section is validated after the code
section, so a module whose tag carries an out-of-range type index
reached the unchecked m_context.types[...] access and tripped a Vector
bounds assertion during validation.

Any WebAssembly.compile() of such a module aborts the WebContent
process.

Validate the tag's type index before using it, the same check
validate(TagType) already performs.
This commit is contained in:
François Guerraz 2026-06-02 09:04:41 +02:00 committed by Ali Mohammad Pur
parent ad6f646d6d
commit be4173af81
2 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Libraries/LibWasm/AbstractMachine/Validator.cpp
View file

@ -2354,6 +2354,7 @@ VALIDATE_INSTRUCTION(throw_)
TRY(validate(tag_index));
auto tag_type = m_context.tags[tag_index.value()];
TRY(validate(tag_type.type()));
auto& type = m_context.types[tag_type.type().value()];
if (!type.is_function())
@ -2414,6 +2415,7 @@ VALIDATE_INSTRUCTION(try_table)
if (auto tag = catch_.matching_tag_index(); tag.has_value()) {
TRY(validate(tag.value()));
auto tag_type = m_context.tags[tag->value()];
TRY(validate(tag_type.type()));
auto& type = m_context.types[tag_type.type().value()];
if (!type.is_function())

10
Tests/LibWeb/Crash/Wasm/compile-throw-with-out-of-range-tag-type.html Normal file
View file

@ -0,0 +1,10 @@
<!DOCTYPE html>
<script>
// A module whose tag references a type index that is out of range, used by a
// 'throw' instruction. Validating the throw dereferenced the tag's type index
// without checking it, tripping a Vector bounds assertion.
const bytes = new Uint8Array([
0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x01, 0x05, 0x01, 0x60, 0x00, 0x01, 0x7f, 0x03, 0x02, 0x01, 0x00, 0x0d, 0x05, 0x02, 0x00, 0x01, 0x00, 0x01, 0x07, 0x06, 0x01, 0x02, 0x67, 0x6f, 0x00, 0x00, 0x0a, 0x1d, 0x01, 0x1b, 0x00, 0x41, 0x00, 0x41, 0xaa, 0x01, 0x41, 0x05, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x41, 0x01, 0x08, 0x00, 0x74, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x72, 0x0b
]);
WebAssembly.compile(bytes).then(() => {}, () => {});
</script>