Stream: git-wasmtime

Topic: wasmtime / PR #13819 guard guest cursor and delta in wasi...

Wasmtime GitHub notifications bot (Jul 05 2026 at 09:52):

netliomax25-code opened PR #13819 from netliomax25-code:keyvalue-guard-cursor-delta to bytecodealliance:main:

1. list_keys casts the guest-supplied cursor with as usize and slices &keys[cursor..], so a cursor past the number of keys panics the host with an out-of-range slice, and the cast also truncates the u64 on 32-bit hosts.
2. increment computes current_value + delta, which panics on overflow in debug builds and silently wraps to a smaller value in release, so the returned counter can go backwards.

Clamped the cursor to keys.len() (via try_from + min) and switched increment to checked_add, returning an error on overflow. Both values come straight from the guest, so the checks live in the callee. Added unit tests that panic on the current code and pass with the fix.

Wasmtime GitHub notifications bot (Jul 05 2026 at 09:52):

netliomax25-code requested dicej for a review on PR #13819.

Wasmtime GitHub notifications bot (Jul 05 2026 at 09:52):

netliomax25-code requested wasmtime-wasi-reviewers for a review on PR #13819.

Wasmtime GitHub notifications bot (Jul 06 2026 at 16:09):

:thumbs_up: dicej submitted PR review:

Thanks!

Wasmtime GitHub notifications bot (Jul 08 2026 at 18:54):

dicej added PR #13819 guard guest cursor and delta in wasi-keyvalue in-memory store to the merge queue.

Wasmtime GitHub notifications bot (Jul 08 2026 at 19:18):

:check: dicej merged PR #13819.

Wasmtime GitHub notifications bot (Jul 08 2026 at 19:18):

dicej removed PR #13819 guard guest cursor and delta in wasi-keyvalue in-memory store from the merge queue.

Last updated: Jul 29 2026 at 05:03 UTC