Skip to content

Fix address overflow bug in wasm2c#1401

Merged
binji merged 1 commit intomasterfrom
wasm2c-address-overflow
Apr 29, 2020
Merged

Fix address overflow bug in wasm2c#1401
binji merged 1 commit intomasterfrom
wasm2c-address-overflow

Conversation

@binji
Copy link
Member

@binji binji commented Apr 29, 2020

This only occurs when the immediate offset is small (int sized). The
stack offset is u32 and the immediate is an int, so the usual
arithmetic conversions converts the result to a u32, which wraps the
address before checking for overflow.

There are already spec tests for overflow, but these use an offset of
4294967295, which is long (at least on LP64 systems). This means
that the sum's type is u32 + long which is long. This is why the
tests pass. I've added additional tests for these cases here:
WebAssembly/spec#1188

This fixes issue #1400.

This only occurs when the immediate offset is small (`int` sized). The
stack offset is `u32` and the immediate is an `int`, so the usual
arithmetic conversions converts the result to a `u32`, which wraps the
address before checking for overflow.

There are already spec tests for overflow, but these use an offset of
`4294967295`, which is `long` (at least on LP64 systems). This means
that the sum's type is `u32 + long` which is `long`. This is why the
tests pass. I've added additional tests for these cases here:
WebAssembly/spec#1188

This fixes issue #1400.
@binji binji requested a review from sbc100 April 29, 2020 00:15
@binji binji merged commit 5c48f3b into master Apr 29, 2020
@binji binji deleted the wasm2c-address-overflow branch April 29, 2020 07:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants