Skip to content

improve logic of heap_type validation when ref.null #4372

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 9 commits into
base: main
Choose a base branch
from

Conversation

Septa2112
Copy link
Contributor

PR #4300 introduced the rationale for validating heap_type.

This patch moves the validation before the computation of type1 to prevent potential overflow.

PR bytecodealliance#4300 introduced the rationale for validating heap_type.
This patch moves the validation before the computation of
type1 to prevent potential overflow.
@Septa2112
Copy link
Contributor Author

Further improved the heap type check logic:

  1. Moved the heap type validation ahead of the if (!is_byte_a_type...) check. Depending on whether heap_type >= 0, different methods are used to get type1.

  2. The type_index check is now performed only when heap_type >= 0, to ensure that type1 is correctly retrieved in this case.

  3. Why not checking type_index when heap_type < 0? Because in the current WAMR implementation, if wasm_is_valid_heap_type(heap_type) is true, then the condition if (!is_byte_a_type(type1) || wasm_is_type_multi_byte_type(type1)) will always be false.

@Septa2112 Septa2112 changed the title Prevent potential overflow improve logic of heap_type validation when ref.null Jun 25, 2025
}
}
else {
if (!wasm_is_valid_heap_type(heap_type)) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Guess heap_type should be type1.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Likewise, considering the same code context in function wasm_loader_prepare_bytecode when WASM_OP_REF_NULL , it might be better to keep the check for int32 heap_type here.

const uint8 *p_copy = p;
int32 heap_type;
read_leb_int32(p_copy, p_end, heap_type);
#endif
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If following the spec, s33 should be a type index. might rename it as type_index better.

Copy link
Contributor Author

@Septa2112 Septa2112 Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it might not be appropriate to rename heap_type to type_idx here:

  1. type_idx has already been defined as a uint32 at the beginning of this function.
  2. Based on the surrounding lines of code in function wasm_loader_prepare_bytecode when WASM_OP_REF_NULL, I think it's clearer and more consistent to keep the name heap_type.
    pb_read_leb_int32(p, p_end, heap_type);
    if (heap_type >= 0) {
    if (!check_type_index(module, module->type_count, heap_type,
    error_buf, error_buf_size)) {
    goto fail;
    }
    wasm_set_refheaptype_typeidx(&wasm_ref_type.ref_ht_typeidx,
    true, heap_type);
    ref_type = wasm_ref_type.ref_type;
    }
    else {
    if (!wasm_is_valid_heap_type(heap_type)) {
    set_error_buf(error_buf, error_buf_size,
    "unknown type");
    goto fail;
    }

CHECK_BUF(p, p_end, 1);
type1 = read_uint8(p);

#if WASM_ENABLE_GC == 0
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

like above, in L839, rename type1 to heap_type or abs_heaptype.

goto fail;
}
}

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

after wasm_is_valid_heap_type(), not sure we still need is_byte_a_type() and wasm_is_type_multi_byte_type().

const uint8 *p_copy = p;
int32 heap_type;
read_leb_int32(p_copy, p_end, heap_type);
#endif
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another thing, L872 will read it again. Seems we can remove either one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants