Binaryen: array_ptr_impl can cause buffer overflow in 32-bits build

[guhe120]

Hi,

In function array_ptr_impl in Binaryen.hpp:

template

inline array_ptr array_ptr_impl (interpreter_interface* interface, uint32_t ptr, uint32_t length)

{
return array_ptr((T*)(interface->get_validated_pointer(ptr, length * (uint32_t)sizeof(T))));
}

Here we have full control of the |length| parameter, in 32-bits process, length * (uint32_t)sizeof(T) could overflow 32-bits integer range and results in a very small value, which then bypasses the boundary check in get_validated_pointer and returns an over-sized array_ptr.

Then we can read/write out of the bounds of the wasm memory buffer with this over-sized array_ptr.

This is a submission to EOS bug bounty program.

This bug credits to:

Yuki Chen of Qihoo 360 Vulcan Team.

Thank you!