Bug 201016 - Wasm::FunctionParser is failing to enforce maxFunctionLocals.
Summary: Wasm::FunctionParser is failing to enforce maxFunctionLocals.
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mark Lam
URL:
Keywords: InRadar
Depends on:
Blocks: 201006
  Show dependency treegraph
 
Reported: 2019-08-21 18:22 PDT by Mark Lam
Modified: 2019-08-28 13:57 PDT (History)
7 users (show)

See Also:


Attachments
proposed patch. (4.61 KB, patch)
2019-08-21 18:24 PDT, Mark Lam
no flags Details | Formatted Diff | Diff
proposed patch. (4.66 KB, patch)
2019-08-21 18:27 PDT, Mark Lam
ysuzuki: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Lam 2019-08-21 18:22:10 PDT
Currently, Wasm::FunctionParser is allowing

    maxFunctionParams + maxFunctionLocals * maxFunctionLocals

... locals, which is 0x9502FCE8.  It should be enforcing max locals of maxFunctionLocals instead.

<rdar://problem/54579911>
Comment 1 Mark Lam 2019-08-21 18:24:49 PDT
Created attachment 376961 [details]
proposed patch.
Comment 2 Mark Lam 2019-08-21 18:27:25 PDT
Created attachment 376962 [details]
proposed patch.
Comment 3 Yusuke Suzuki 2019-08-21 18:31:01 PDT
Comment on attachment 376962 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=376962&action=review

r=me with comment.

> Source/JavaScriptCore/wasm/WasmFunctionParser.h:118
> +    uint32_t functionSectionsCount;

I think this is not a number of function-sections. So maybe, localGroupCount is better.

> Source/JavaScriptCore/wasm/WasmFunctionParser.h:121
> +    WASM_PARSER_FAIL_IF(!parseVarUInt32(functionSectionsCount), "can't get number of Function sections");

Ditto.
Comment 4 Mark Lam 2019-08-21 18:38:41 PDT
Thanks for the review.

(In reply to Yusuke Suzuki from comment #3)
> Comment on attachment 376962 [details]
> > Source/JavaScriptCore/wasm/WasmFunctionParser.h:118
> > +    uint32_t functionSectionsCount;
> 
> I think this is not a number of function-sections. So maybe, localGroupCount
> is better.

Fixed.

> > Source/JavaScriptCore/wasm/WasmFunctionParser.h:121
> > +    WASM_PARSER_FAIL_IF(!parseVarUInt32(functionSectionsCount), "can't get number of Function sections");
> 
> Ditto.

Fixed.
Comment 5 Mark Lam 2019-08-21 18:43:06 PDT
Landed in r248989: <http://trac.webkit.org/r248989>.