Prevent an integer overflow when checking start_func_index#3577
Prevent an integer overflow when checking start_func_index#3577lum1n0us wants to merge 1 commit intobytecodealliance:mainfrom
Conversation
| if (module->start_func_index != (uint32)-1 | ||
| && (module->start_func_index | ||
| >= module->import_func_count + module->func_count)) { | ||
| >= (uint64)module->import_func_count + module->func_count)) { |
There was a problem hiding this comment.
the overflow check should be done earlier, regardless of start_func_index.
There was a problem hiding this comment.
yes, maybe we can check the integer overflow after reading module->func_count
|
btw, does it make much sense to perform fuzzing on the aot loader? (i guess it's what you are doing. this is just a guess because i have no access to the given oss-fuzz url.) |
|
It is a problem. We're kind of hesitant to do that(fix aot related problems). We do need to trust aot modules but also want to robust(for aot_loader) and protection(since there is no case for wamrc currently). So, we are using a "better than nothing" policy until figure it out clearly. |
|
Use #3579 to fix |
3 participants
69920