Changeset 207843 in webkit

Timestamp:

Oct 25, 2016 2:10:46 PM (8 years ago)

Author:

jfbastien@apple.com

Message:

WebAssembly: fix unknown section name handling, and check for section size overflow
​https://bugs.webkit.org/show_bug.cgi?id=163959

See: ​https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md#high-level-structure

Name length and name are already included in the payload length.

Reviewed by Filip Pizlo.

• wasm/WasmModuleParser.cpp:

(JSC::Wasm::ModuleParser::parse):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• wasm/WasmModuleParser.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-10-25  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly: fix unknown section name handling, and check for section size overflow
+        https://bugs.webkit.org/show_bug.cgi?id=163959
+
+        See: https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md#high-level-structure
+
+        Name length and name are already included in the payload length.
+
+        Reviewed by Filip Pizlo.
+
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parse):
+
 2016-10-25  Christopher Reid  <Christopher.Reid@am.sony.com>
 

trunk/Source/JavaScriptCore/wasm/WasmModuleParser.cpp

@@ -89 +89 @@
             if (sectionByte < Sections::Unknown)
                 section = static_cast<Sections::Section>(sectionByte);
-        } else {
-            uint32_t sectionNameLength;
-            if (!parseVarUInt32(sectionNameLength)) {
-                // FIXME improve error message https://bugs.webkit.org/show_bug.cgi?id=163919
-                m_errorMessage = "couldn't get section name length";
-                return false;
-            }
-
-            // Make sure we can read up to the section's size.
-            if (m_offset + sectionNameLength + WTF::LEBDecoder::max32BitLEBByteLength >= length()) {
-                // FIXME improve error message https://bugs.webkit.org/show_bug.cgi?id=163919
-                m_errorMessage = "section length is bigger than actual size";
-                return false;
-            }
-
-            // We don't support any custom sections yet.
-
-            m_offset += sectionNameLength;
         }
 
@@ -122 +104 @@
         }
 
-        unsigned end = m_offset + sectionLength;
+        if (sectionLength > length() - m_offset) {
+            // FIXME improve error message https://bugs.webkit.org/show_bug.cgi?id=163919
+            m_errorMessage = "section content would overflow Module's size";
+            return false;
+        }
+
+        auto end = m_offset + sectionLength;
 
         switch (section) {
@@ -175 +163 @@
             if (verbose)
                 dataLogLn("Unknown section, skipping.");
+            // Ignore section's name LEB and bytes: they're already included in sectionLength.
             m_offset += sectionLength;
             break;