Wasmtime GitHub notifications bot (Oct 23 2026 at 23:34): Wasmtime GitHub notifications bot (Oct 23 2026 at 23:34):jrandolf removed the review request for wasmtime-core-reviewers from PR #14976.
Wasmtime GitHub notifications bot (Oct 23 2026 at 23:34):jrandolf requested pchickey for a review on PR #14976.
Wasmtime GitHub notifications bot (Oct 23 2026 at 23:34):jrandolf requested wasmtime-core-reviewers for a review on PR #14976.
Wasmtime GitHub notifications bot (Oct 23 2026 at 23:34):jrandolf opened PR #14976 from jrandolf:empty-core-rec-groups to bytecodealliance:main:
An empty core rec group in a component panics
Component::new, andwasmtime compile, with the default configuration. These all validate:
(component (core rec))indexes out of bounds.(component (core rec) (core type (module)))unwraps anErr(()).(component (core type (sub (array i8))) (core rec))indexes out of bounds.The component translator found each core rec group from the type at the group's first index, which an empty group doesn't have, so it looked past the end of the core types or at the next definition's type. Empty rec groups define no types, so this skips them.
Found by fuzzing Wasmtime with components generated from the component model's binary grammar (bytecodealliance/wasm-tools#2796).
Wasmtime GitHub notifications bot (Oct 26 2026 at 14:53)::speech_balloon: alexcrichton created PR review comment:
Could this perhaps use a similar pattern to core modules to avoid the need to special-case here? In
module_environ.rsthe translation here is based on the number of types in a module, and I believe that could be done here as well by looking at the core type count within the component before/after the validator runs.
Wasmtime GitHub notifications bot (Oct 26 2026 at 14:53)::memo: alexcrichton submitted PR review.
Wasmtime GitHub notifications bot (Oct 26 2026 at 16:41):jrandolf updated PR #14976.
Wasmtime GitHub notifications bot (Oct 26 2026 at 16:41)::memo: jrandolf submitted PR review.
Wasmtime GitHub notifications bot (Oct 26 2026 at 16:41)::speech_balloon: jrandolf created PR review comment:
This now works like
module_environ.rs. It counts the core types before and after validating the section, then interns each rec group starting from its first type. An empty rec group adds no types, so it no longer needs a special case.
Wasmtime GitHub notifications bot (Oct 26 2026 at 16:42):jrandolf requested alexcrichton for a review on PR #14976.
Wasmtime GitHub notifications bot (Oct 26 2026 at 16:42):jrandolf edited PR #14976:
An empty core rec group in a component panics
Component::new, andwasmtime compile, with the default configuration. These all validate:
(component (core rec))indexes out of bounds.(component (core rec) (core type (module)))unwraps anErr(()).(component (core type (sub (array i8))) (core rec))indexes out of bounds.The component translator found each core rec group from the type at the group's first index, which an empty group doesn't have, so it looked past the end of the core types or at the next definition's type. Like the type section of core modules, it now iterates over the core types that the validator added for the section instead of over the section's rec groups, so empty rec groups have nothing to intern.
Found by fuzzing Wasmtime with components generated from the component model's binary grammar (bytecodealliance/wasm-tools#2796).
Wasmtime GitHub notifications bot (Oct 26 2026 at 22:15)::thumbs_up: alexcrichton submitted PR review.
Wasmtime GitHub notifications bot (Oct 26 2026 at 22:15):alexcrichton added PR #14976 Don't panic on empty core rec groups in components to the merge queue.
Wasmtime GitHub notifications bot (Oct 26 2026 at 22:47)::check: alexcrichton merged PR #14976.
Wasmtime GitHub notifications bot (Oct 26 2026 at 22:47):alexcrichton removed PR #14976 Don't panic on empty core rec groups in components from the merge queue.
Last updated: Oct 31 2026 at 23:03 UTC