Skip to content

Pass the exported name to the after_export event.#2

Closed
dschuff wants to merge 1 commit into
masterfrom
after_export
Closed

Pass the exported name to the after_export event.#2
dschuff wants to merge 1 commit into
masterfrom
after_export

Conversation

@dschuff

@dschuff dschuff commented Oct 5, 2015

Copy link
Copy Markdown
Member

No description provided.

@dschuff dschuff closed this Oct 5, 2015
@dschuff
dschuff deleted the after_export branch October 5, 2015 23:15
sumayyanc pushed a commit to pose-dev/wabt that referenced this pull request Aug 2, 2019
@keithw keithw mentioned this pull request Nov 17, 2022
dimitry- pushed a commit to dimitry-/wabt that referenced this pull request Nov 24, 2022
Replace access to __stack_pointer with actual stack.
sbc100 pushed a commit that referenced this pull request Jul 13, 2026
ASan, release build, `wasm2wat` on a crafted module:

    ==…==ERROR: AddressSanitizer: heap-buffer-overflow
      #0 wabt::MakeTypeBindingReverseMapping(...) ir.cc
      #1 wabt::ApplyNames(wabt::Module*)
      #2 ProgramMain
    ... located 1535 bytes after 24-byte region

Found while going over the name-section handlers. The local subsection
stores a (local index, name) pair per entry. `OnLocalNameLocalCount`
checks the entry count against the function's param+local count, but the
per-entry local index in `OnLocalName` is never range-checked before it
becomes a `Binding`. `MakeTypeBindingReverseMapping` sizes the reverse
map to that local count and writes each name at `binding.index`, guarded
only by an `assert`. A name whose index sits past the function's locals
writes off the end of the vector: a debug build trips the assert, a
release build corrupts the heap. Reached from an untrusted `.wasm`
through `wasm2wat` and `wasm2c` (both call `ApplyNames` and read debug
names by default), on an otherwise valid module.

Skip entries that land outside the mapping. Valid modules only name real
locals, so their output does not change. The added test names local
index 5 of a one-param function; before the fix `wasm2wat` aborts, after
it prints the module with the stray name dropped.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant