Bug 201016 – Wasm::FunctionParser is failing to enforce maxFunctionLocals.

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Lam]

Currently, Wasm::FunctionParser is allowing

    maxFunctionParams + maxFunctionLocals * maxFunctionLocals

... locals, which is 0x9502FCE8.  It should be enforcing max locals of maxFunctionLocals instead.

<rdar://problem/54579911>

[Mark Lam]

Created attachment 376961 [details]
proposed patch.

[Mark Lam]

Created attachment 376962 [details]
proposed patch.

[Yusuke Suzuki]

Comment on attachment 376962 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=376962&action=review

r=me with comment.

> Source/JavaScriptCore/wasm/WasmFunctionParser.h:118
> +    uint32_t functionSectionsCount;

I think this is not a number of function-sections. So maybe, localGroupCount is better.

> Source/JavaScriptCore/wasm/WasmFunctionParser.h:121
> +    WASM_PARSER_FAIL_IF(!parseVarUInt32(functionSectionsCount), "can't get number of Function sections");

Ditto.

[Mark Lam]

Thanks for the review.

(In reply to Yusuke Suzuki from comment #3)
> Comment on attachment 376962 [details]
> > Source/JavaScriptCore/wasm/WasmFunctionParser.h:118
> > +    uint32_t functionSectionsCount;
> 
> I think this is not a number of function-sections. So maybe, localGroupCount
> is better.

Fixed.

> > Source/JavaScriptCore/wasm/WasmFunctionParser.h:121
> > +    WASM_PARSER_FAIL_IF(!parseVarUInt32(functionSectionsCount), "can't get number of Function sections");
> 
> Ditto.

Fixed.

[Mark Lam]

Landed in r248989: <http://trac.webkit.org/r248989>.