saulecabrera opened PR #8001 from saulecabrera:winch-fix-dynamic-heap-bounds
to bytecodealliance:main
:
This commit fixes a fuzz bug in which the current implementation was incorrectly clobbering the index register of a memory access (for addition overflow check) and then using that same clobbered register to perform the memory access. The clobbered register contained the value:
index + offset + access_size
, which resulting in an incorrect access and consequently in an incorrectHeapOutOfBounds
trap.This bug is only reproducible when modifying Wasmtime's memory settings, forcing the heap to be treated as
Dynamic
.Currently in Winch there's no easy way to have specific Wasmtime configurations, so having a filetests for this case is not straightforward. I've opted to add an integration test, in which it's easier to configure Wasmtime.
Note that the
tests/all/winch.rs
file is temporary, and the plan is to execute all the other integration tests with Winch at some point. In the case ofmemory.rs
, that will be once Winch supportsmemory64
hoping to reduce the amount of code needed in order to integrate Winch.<!--
Please make sure you include the following information:
If this work has been discussed elsewhere, please include a link to that
conversation. If it was discussed in an issue, just mention "issue #...".Explain why this change is needed. If the details are in an issue already,
this can be brief.Our development process is documented in the Wasmtime book:
https://docs.wasmtime.dev/contributing-development-process.htmlPlease ensure all communication follows the code of conduct:
https://github.com/bytecodealliance/wasmtime/blob/main/CODE_OF_CONDUCT.md
-->
saulecabrera requested fitzgen for a review on PR #8001.
saulecabrera requested wasmtime-compiler-reviewers for a review on PR #8001.
saulecabrera requested wasmtime-core-reviewers for a review on PR #8001.
saulecabrera requested elliottt for a review on PR #8001.
fitzgen submitted PR review.
saulecabrera has enabled auto merge for PR #8001.
saulecabrera updated PR #8001.
saulecabrera merged PR #8001.
Last updated: Dec 23 2024 at 12:05 UTC