Currently, Wasm::FunctionParser is allowing maxFunctionParams + maxFunctionLocals * maxFunctionLocals ... locals, which is 0x9502FCE8. It should be enforcing max locals of maxFunctionLocals instead. <rdar://problem/54579911>
Created attachment 376961 [details] proposed patch.
Created attachment 376962 [details] proposed patch.
Comment on attachment 376962 [details] proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=376962&action=review r=me with comment. > Source/JavaScriptCore/wasm/WasmFunctionParser.h:118 > + uint32_t functionSectionsCount; I think this is not a number of function-sections. So maybe, localGroupCount is better. > Source/JavaScriptCore/wasm/WasmFunctionParser.h:121 > + WASM_PARSER_FAIL_IF(!parseVarUInt32(functionSectionsCount), "can't get number of Function sections"); Ditto.
Thanks for the review. (In reply to Yusuke Suzuki from comment #3) > Comment on attachment 376962 [details] > > Source/JavaScriptCore/wasm/WasmFunctionParser.h:118 > > + uint32_t functionSectionsCount; > > I think this is not a number of function-sections. So maybe, localGroupCount > is better. Fixed. > > Source/JavaScriptCore/wasm/WasmFunctionParser.h:121 > > + WASM_PARSER_FAIL_IF(!parseVarUInt32(functionSectionsCount), "can't get number of Function sections"); > > Ditto. Fixed.
Landed in r248989: <http://trac.webkit.org/r248989>.