Stream: git-wasmtime

Topic: wasmtime / issue #14100 Empty Component Panics Native DWA...

Wasmtime GitHub notifications bot (Aug 10 2026 at 14:16):

cla7aye15I4nd opened issue #14100:

Summary

When native debug information is enabled, an attacker-supplied empty WebAssembly component reaches simulated-DWARF generation with no translated core modules. The compiler unwraps the first translation without checking that one exists, so the valid (component) input panics an unisolated compilation process instead of producing a component artifact or recoverable error.

Detail

build_component_artifacts accepts the empty component and later asks Cranelift to append DWARF. generate_simulated_dwarf in crates/cranelift/src/debug/transform/simulate.rs obtains its source file from:

let di = &compilation.translations.iter().next().unwrap().1.debuginfo;

An empty component has no core-module translations, so iter().next() returns None. The stock wasmtime compile -D debug-info=y path does not catch this panic. No custom embedding or harness is required; the reproducer passes the component directly to Wasmtime's existing compiler CLI.

Reproduce

set -eu
git clone --depth 1 https://github.com/bytecodealliance/wasmtime.git
cd wasmtime
git rev-parse HEAD

cargo build --bin wasmtime --no-default-features \
  --features 'run,wat,cranelift,compile,component-model,clap/default,clap/wrap_help'

printf '%s\n' '(component)' > empty-component.wat
set +e
RUST_BACKTRACE=0 ./target/debug/wasmtime compile -D debug-info=y \
  -o empty-component.cwasm empty-component.wat
status=$?
set -e
printf 'exit=%s\n' "$status"

Observed output on the affected HEAD:

3ebfbe5af4927c157d6fcaca42b8dbb6d17b73fb

thread 'main' (...) panicked at crates/cranelift/src/debug/transform/simulate.rs:300:58:
called `Option::unwrap()` on a `None` value
exit=101

Wasmtime GitHub notifications bot (Aug 10 2026 at 14:16):

cla7aye15I4nd added the bug label to Issue #14100.

Wasmtime GitHub notifications bot (Aug 10 2026 at 14:17):

alexcrichton added the wasmtime:debugging label to Issue #14100.

Wasmtime GitHub notifications bot (Aug 10 2026 at 14:17):

alexcrichton added the wasm-proposal:component-model label to Issue #14100.

Wasmtime GitHub notifications bot (Aug 13 2026 at 17:07):

fitzgen closed issue #14100:

Summary

When native debug information is enabled, an attacker-supplied empty WebAssembly component reaches simulated-DWARF generation with no translated core modules. The compiler unwraps the first translation without checking that one exists, so the valid (component) input panics an unisolated compilation process instead of producing a component artifact or recoverable error.

Detail

build_component_artifacts accepts the empty component and later asks Cranelift to append DWARF. generate_simulated_dwarf in crates/cranelift/src/debug/transform/simulate.rs obtains its source file from:

let di = &compilation.translations.iter().next().unwrap().1.debuginfo;

An empty component has no core-module translations, so iter().next() returns None. The stock wasmtime compile -D debug-info=y path does not catch this panic. No custom embedding or harness is required; the reproducer passes the component directly to Wasmtime's existing compiler CLI.

Reproduce

set -eu
git clone --depth 1 https://github.com/bytecodealliance/wasmtime.git
cd wasmtime
git rev-parse HEAD

cargo build --bin wasmtime --no-default-features \
  --features 'run,wat,cranelift,compile,component-model,clap/default,clap/wrap_help'

printf '%s\n' '(component)' > empty-component.wat
set +e
RUST_BACKTRACE=0 ./target/debug/wasmtime compile -D debug-info=y \
  -o empty-component.cwasm empty-component.wat
status=$?
set -e
printf 'exit=%s\n' "$status"

Observed output on the affected HEAD:

3ebfbe5af4927c157d6fcaca42b8dbb6d17b73fb

thread 'main' (...) panicked at crates/cranelift/src/debug/transform/simulate.rs:300:58:
called `Option::unwrap()` on a `None` value
exit=101

Last updated: Aug 30 2026 at 09:07 UTC