Wasmtime GitHub notifications bot (Oct 19 2026 at 18:25): Wasmtime GitHub notifications bot (Oct 19 2026 at 18:25):pchickey opened PR #14826 from pchickey:fix_ghsa_mghf_main to bytecodealliance:main:
Previously, the JTSequence macro-instruction contained a conditional branch for the default (selector greater than table size) case. This default branch on aarch64 has a +/- 1MiB range. The JTSequence also contains the entire table of 32-bit offsets for each br_table target. As a result of these two facts, a branch may have an out-of-bounds target and silently wrap the offset, resulting in an incorrect branch target.
This PR fixes the sequence to instead use the offset table for the default case too. The conditional branch is converted into a conditional-select that clamps the index to the last table entry (which we fill with the default target) if out-of-bounds.
This PR was authored by @cfallin
Wasmtime GitHub notifications bot (Oct 19 2026 at 18:40):pchickey requested alexcrichton for a review on PR #14826.
Wasmtime GitHub notifications bot (Oct 19 2026 at 18:44)::thumbs_up: alexcrichton submitted PR review.
Wasmtime GitHub notifications bot (Oct 19 2026 at 18:44):alexcrichton added PR #14826 Cranelift/aarch64: fix br_tables with very large target count. to the merge queue
Wasmtime GitHub notifications bot (Oct 19 2026 at 19:08)::check: alexcrichton merged PR #14826.
Wasmtime GitHub notifications bot (Oct 19 2026 at 19:08):alexcrichton removed PR #14826 Cranelift/aarch64: fix br_tables with very large target count. from the merge queue
Last updated: Oct 31 2026 at 23:03 UTC