Skip to content

Commit 0fbbb75

Browse files
authored
Fix bounds check for error-context.debug-message (#12879)
* Fix bounds check for `error-context.debug-message` This fixes a possible subsequent panic when lowering the message itself. * Review comments
1 parent 758c729 commit 0fbbb75

2 files changed

Lines changed: 56 additions & 2 deletions

File tree

crates/wasmtime/src/runtime/component/concurrent/futures_and_streams.rs

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4205,11 +4205,15 @@ impl Instance {
42054205

42064206
let lower_cx = &mut LowerContext::new(store, options, self);
42074207
let debug_msg_address = usize::try_from(debug_msg_address)?;
4208-
// Lower the string into the component's memory
4208+
// Lower the string into the component's memory.
4209+
//
4210+
// Note that the "8" here is the size of a WIT `string` in linear
4211+
// memory, the ptr+length. This'll need to be updated when `memory64`
4212+
// comes along. (FIXME(#4311))
42094213
let offset = lower_cx
42104214
.as_slice_mut()
42114215
.get(debug_msg_address..)
4212-
.and_then(|b| b.get(..debug_msg.bytes().len()))
4216+
.and_then(|b| b.get(..8))
42134217
.map(|_| debug_msg_address)
42144218
.ok_or_else(|| crate::format_err!("invalid debug message pointer: out of bounds"))?;
42154219
debug_msg

tests/misc_testsuite/component-model/async/error-context.wast

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,3 +34,53 @@
3434
(core func $error-context-drop (canon error-context.drop))
3535
(core instance $i (instantiate $m (with "" (instance (export "error-context.drop" (func $error-context-drop))))))
3636
)
37+
38+
;; Test edge-case behavior of `error-context.debug-message`.
39+
(component definition $A
40+
(core module $libc
41+
(memory (export "memory") 1)
42+
(global $bump (mut i32) (i32.const 100))
43+
(func (export "realloc") (param i32 i32 i32 i32) (result i32)
44+
(local $ret i32)
45+
(if (local.get 0) (then unreachable))
46+
(if (local.get 1) (then unreachable))
47+
(if (i32.ne (local.get 2) (i32.const 1)) (then unreachable))
48+
(local.set $ret (global.get $bump))
49+
(global.set $bump (i32.add (global.get $bump) (local.get 3)))
50+
(local.get $ret)
51+
)
52+
)
53+
(core instance $libc (instantiate $libc))
54+
55+
(core module $Core
56+
(import "" "mem" (memory 1))
57+
(import "" "error-context.new" (func $error-context.new (param i32 i32) (result i32)))
58+
(import "" "error-context.debug-message" (func $error-context.debug-message (param i32 i32)))
59+
(import "" "error-context.drop" (func $error-context.drop (param i32)))
60+
61+
(func (export "run") (param $dst i32)
62+
(local $handle i32)
63+
(i32.store8 (i32.const 0) (i32.const 0x61)) ;; 'a'
64+
(local.set $handle (call $error-context.new (i32.const 0) (i32.const 1)))
65+
(call $error-context.debug-message (local.get $handle) (local.get $dst))
66+
(call $error-context.drop (local.get $handle))
67+
)
68+
)
69+
70+
(core func $error-context.new (canon error-context.new (memory $libc "memory")))
71+
(core func $error-context.debug-message (canon error-context.debug-message (memory $libc "memory") (realloc (func $libc "realloc"))))
72+
(core func $error-context.drop (canon error-context.drop))
73+
74+
(core instance $core (instantiate $Core (with "" (instance
75+
(export "mem" (memory $libc "memory"))
76+
(export "error-context.new" (func $error-context.new))
77+
(export "error-context.debug-message" (func $error-context.debug-message))
78+
(export "error-context.drop" (func $error-context.drop))
79+
))))
80+
81+
(func (export "run") (param "p" u32) (canon lift (core func $core "run")))
82+
)
83+
84+
(component instance $A $A)
85+
(assert_return (invoke "run" (u32.const 65528)))
86+
(assert_trap (invoke "run" (u32.const 65532)) "invalid debug message pointer")

0 commit comments

Comments
 (0)