Changeset 209955 in webkit

Timestamp:

Dec 16, 2016 7:19:48 PM (7 years ago)

Author:

sbarati@apple.com

Message:

WebAssembly: We still have some incorrect parsing productions inside unreachable code
​https://bugs.webkit.org/show_bug.cgi?id=165981

Reviewed by Keith Miller.

This hardens our parsing for CallIndirect and Loop/Block/If to be exactly like their reachable variant.

It also fixes a more nefarious bug in which we were decoding an extra varuint32
for Br/BrIf inside unreachable code.

• wasm/WasmFunctionParser.h:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• wasm/WasmFunctionParser.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-12-16  Saam Barati  <sbarati@apple.com>
+
+        WebAssembly: We still have some incorrect parsing productions inside unreachable code
+        https://bugs.webkit.org/show_bug.cgi?id=165981
+
+        Reviewed by Keith Miller.
+
+        This hardens our parsing for CallIndirect and Loop/Block/If to be exactly like their reachable variant.
+        
+        It also fixes a more nefarious bug in which we were decoding an extra varuint32
+        for Br/BrIf inside unreachable code.
+
+        * wasm/WasmFunctionParser.h:
+
 2016-12-16  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/wasm/WasmFunctionParser.h

@@ -528 +528 @@
     case Block: {
         m_unreachableBlocks++;
-        int8_t unused;
-        WASM_PARSER_FAIL_IF(!parseInt7(unused), "can't get inline type for ", op, " in unreachable context");
+        Type unused;
+        WASM_PARSER_FAIL_IF(!parseResultType(unused), "can't get inline type for ", op, " in unreachable context");
         return { };
     }
@@ -546 +546 @@
     }
 
+    case CallIndirect: {
+        uint32_t unused;
+        uint8_t unused2;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(unused), "can't get call_indirect's signature index in unreachable context");
+        WASM_PARSER_FAIL_IF(!parseVarUInt1(unused2), "can't get call_indirect's reserved byte in unreachable context");
+        return { };
+    }
 
     // two immediate cases
     FOR_EACH_WASM_MEMORY_LOAD_OP(CREATE_CASE)
-    FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_CASE)
-    case Br:
-    case BrIf:
-    case CallIndirect: {
+    FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_CASE) {
         uint32_t unused;
         WASM_PARSER_FAIL_IF(!parseVarUInt32(unused), "can't get first immediate for ", op, " in unreachable context");
@@ -569 +573 @@
     case GetGlobal:
     case SetGlobal:
+    case Br:
+    case BrIf:
     case Call: {
         uint32_t unused;