Skip to content

Commit 2eb6006

Browse files
wenyonghwenyongh
authored
Fix read and validation of misc/simd/atomic sub opcodes (#3115)
The format of sub opcodes after misc, simd and atomic prefix is leb u32. The issue was found in #2921.
1 parent b3f728c commit 2eb6006

File tree

7 files changed

+75
-28
lines changed

7 files changed

+75
-28
lines changed

‎RELEASE_NOTES.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
- fast-interp: Fix frame_offset pop order (#3101)
2525
- Fix AOT compilation on MacOS (#3102)
2626
- fast-interp: Fix block with parameter in polymorphic stack issue (#3112)
27+
- Fix read and validation of misc/simd/atomic sub opcodes (#3115)
2728

2829
### Enhancements
2930
- Clear compilation warning and dead code (#3002)

‎core/iwasm/compilation/aot_compiler.c

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1050,7 +1050,9 @@ aot_compile_func(AOTCompContext *comp_ctx, uint32 func_index)
10501050
uint32 opcode1;
10511051

10521052
read_leb_uint32(frame_ip, frame_ip_end, opcode1);
1053-
opcode = (uint32)opcode1;
1053+
/* opcode1 was checked in loader and is no larger than
1054+
UINT8_MAX */
1055+
opcode = (uint8)opcode1;
10541056

10551057
#if WASM_ENABLE_BULK_MEMORY != 0
10561058
if (WASM_OP_MEMORY_INIT <= opcode
@@ -1211,10 +1213,13 @@ aot_compile_func(AOTCompContext *comp_ctx, uint32 func_index)
12111213
case WASM_OP_ATOMIC_PREFIX:
12121214
{
12131215
uint8 bin_op, op_type;
1216+
uint32 opcode1;
1217+
1218+
read_leb_uint32(frame_ip, frame_ip_end, opcode1);
1219+
/* opcode1 was checked in loader and is no larger than
1220+
UINT8_MAX */
1221+
opcode = (uint8)opcode1;
12141222

1215-
if (frame_ip < frame_ip_end) {
1216-
opcode = *frame_ip++;
1217-
}
12181223
if (opcode != WASM_OP_ATOMIC_FENCE) {
12191224
read_leb_uint32(frame_ip, frame_ip_end, align);
12201225
read_leb_uint32(frame_ip, frame_ip_end, offset);
@@ -1364,11 +1369,17 @@ aot_compile_func(AOTCompContext *comp_ctx, uint32 func_index)
13641369
#if WASM_ENABLE_SIMD != 0
13651370
case WASM_OP_SIMD_PREFIX:
13661371
{
1372+
uint32 opcode1;
1373+
13671374
if (!comp_ctx->enable_simd) {
13681375
goto unsupport_simd;
13691376
}
13701377

1371-
opcode = *frame_ip++;
1378+
read_leb_uint32(frame_ip, frame_ip_end, opcode1);
1379+
/* opcode1 was checked in loader and is no larger than
1380+
UINT8_MAX */
1381+
opcode = (uint8)opcode1;
1382+
13721383
/* follow the order of enum WASMSimdEXTOpcode in
13731384
wasm_opcode.h */
13741385
switch (opcode) {

‎core/iwasm/fast-jit/jit_frontend.c

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2257,7 +2257,9 @@ jit_compile_func(JitCompContext *cc)
22572257
uint32 opcode1;
22582258

22592259
read_leb_uint32(frame_ip, frame_ip_end, opcode1);
2260-
opcode = (uint32)opcode1;
2260+
/* opcode1 was checked in loader and is no larger than
2261+
UINT8_MAX */
2262+
opcode = (uint8)opcode1;
22612263

22622264
switch (opcode) {
22632265
case WASM_OP_I32_TRUNC_SAT_S_F32:
@@ -2396,10 +2398,13 @@ jit_compile_func(JitCompContext *cc)
23962398
case WASM_OP_ATOMIC_PREFIX:
23972399
{
23982400
uint8 bin_op, op_type;
2401+
uint32 opcode1;
2402+
2403+
read_leb_uint32(frame_ip, frame_ip_end, opcode1);
2404+
/* opcode1 was checked in loader and is no larger than
2405+
UINT8_MAX */
2406+
opcode = (uint8)opcode1;
23992407

2400-
if (frame_ip < frame_ip_end) {
2401-
opcode = *frame_ip++;
2402-
}
24032408
if (opcode != WASM_OP_ATOMIC_FENCE) {
24042409
read_leb_uint32(frame_ip, frame_ip_end, align);
24052410
read_leb_uint32(frame_ip, frame_ip_end, offset);

‎core/iwasm/interpreter/wasm_interp_classic.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3511,6 +3511,8 @@ wasm_interp_call_func_bytecode(WASMModuleInstance *module,
35113511
uint32 opcode1;
35123512

35133513
read_leb_uint32(frame_ip, frame_ip_end, opcode1);
3514+
/* opcode1 was checked in loader and is no larger than
3515+
UINT8_MAX */
35143516
opcode = (uint8)opcode1;
35153517

35163518
switch (opcode) {
@@ -3843,8 +3845,12 @@ wasm_interp_call_func_bytecode(WASMModuleInstance *module,
38433845
HANDLE_OP(WASM_OP_ATOMIC_PREFIX)
38443846
{
38453847
uint32 offset = 0, align, addr;
3848+
uint32 opcode1;
38463849

3847-
opcode = *frame_ip++;
3850+
read_leb_uint32(frame_ip, frame_ip_end, opcode1);
3851+
/* opcode1 was checked in loader and is no larger than
3852+
UINT8_MAX */
3853+
opcode = (uint8)opcode1;
38483854

38493855
if (opcode != WASM_OP_ATOMIC_FENCE) {
38503856
read_leb_uint32(frame_ip, frame_ip_end, align);

‎core/iwasm/interpreter/wasm_loader.c

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5092,9 +5092,13 @@ wasm_loader_find_block_addr(WASMExecEnv *exec_env, BlockAddr *block_addr_cache,
50925092
#if (WASM_ENABLE_WAMR_COMPILER != 0) || (WASM_ENABLE_JIT != 0)
50935093
case WASM_OP_SIMD_PREFIX:
50945094
{
5095-
/* TODO: shall we ceate a table to be friendly to branch
5096-
* prediction */
5097-
opcode = read_uint8(p);
5095+
uint32 opcode1;
5096+
5097+
read_leb_uint32(p, p_end, opcode1);
5098+
/* opcode1 was checked in wasm_loader_prepare_bytecode and
5099+
is no larger than UINT8_MAX */
5100+
opcode = (uint8)opcode1;
5101+
50985102
/* follow the order of enum WASMSimdEXTOpcode in wasm_opcode.h
50995103
*/
51005104
switch (opcode) {
@@ -5184,8 +5188,14 @@ wasm_loader_find_block_addr(WASMExecEnv *exec_env, BlockAddr *block_addr_cache,
51845188
#if WASM_ENABLE_SHARED_MEMORY != 0
51855189
case WASM_OP_ATOMIC_PREFIX:
51865190
{
5187-
/* atomic_op (1 u8) + memarg (2 u32_leb) */
5188-
opcode = read_uint8(p);
5191+
uint32 opcode1;
5192+
5193+
/* atomic_op (u32_leb) + memarg (2 u32_leb) */
5194+
read_leb_uint32(p, p_end, opcode1);
5195+
/* opcode1 was checked in wasm_loader_prepare_bytecode and
5196+
is no larger than UINT8_MAX */
5197+
opcode = (uint8)opcode1;
5198+
51895199
if (opcode != WASM_OP_ATOMIC_FENCE) {
51905200
skip_leb_uint32(p, p_end); /* align */
51915201
skip_leb_uint32(p, p_end); /* offset */
@@ -9836,8 +9846,8 @@ wasm_loader_prepare_bytecode(WASMModule *module, WASMFunction *func,
98369846
{
98379847
uint32 opcode1;
98389848

9839-
CHECK_BUF(p, p_end, 1);
9840-
opcode1 = read_uint8(p);
9849+
read_leb_uint32(p, p_end, opcode1);
9850+
98419851
/* follow the order of enum WASMSimdEXTOpcode in wasm_opcode.h
98429852
*/
98439853
switch (opcode1) {
@@ -10498,8 +10508,8 @@ wasm_loader_prepare_bytecode(WASMModule *module, WASMFunction *func,
1049810508
{
1049910509
uint32 opcode1;
1050010510

10501-
CHECK_BUF(p, p_end, 1);
10502-
opcode1 = read_uint8(p);
10511+
read_leb_uint32(p, p_end, opcode1);
10512+
1050310513
#if WASM_ENABLE_FAST_INTERP != 0
1050410514
emit_byte(loader_ctx, opcode1);
1050510515
#endif

‎core/iwasm/interpreter/wasm_mini_loader.c

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3492,8 +3492,11 @@ wasm_loader_find_block_addr(WASMExecEnv *exec_env, BlockAddr *block_addr_cache,
34923492
uint32 opcode1;
34933493

34943494
read_leb_uint32(p, p_end, opcode1);
3495+
/* opcode1 was checked in wasm_loader_prepare_bytecode and
3496+
is no larger than UINT8_MAX */
3497+
opcode = (uint8)opcode1;
34953498

3496-
switch (opcode1) {
3499+
switch (opcode) {
34973500
case WASM_OP_I32_TRUNC_SAT_S_F32:
34983501
case WASM_OP_I32_TRUNC_SAT_U_F32:
34993502
case WASM_OP_I32_TRUNC_SAT_S_F64:
@@ -3549,8 +3552,14 @@ wasm_loader_find_block_addr(WASMExecEnv *exec_env, BlockAddr *block_addr_cache,
35493552
#if WASM_ENABLE_SHARED_MEMORY != 0
35503553
case WASM_OP_ATOMIC_PREFIX:
35513554
{
3552-
/* atomic_op (1 u8) + memarg (2 u32_leb) */
3553-
opcode = read_uint8(p);
3555+
uint32 opcode1;
3556+
3557+
/* atomic_op (u32_leb) + memarg (2 u32_leb) */
3558+
read_leb_uint32(p, p_end, opcode1);
3559+
/* opcode1 was checked in wasm_loader_prepare_bytecode and
3560+
is no larger than UINT8_MAX */
3561+
opcode = (uint8)opcode1;
3562+
35543563
if (opcode != WASM_OP_ATOMIC_FENCE) {
35553564
skip_leb_uint32(p, p_end); /* align */
35563565
skip_leb_uint32(p, p_end); /* offset */
@@ -7464,11 +7473,14 @@ wasm_loader_prepare_bytecode(WASMModule *module, WASMFunction *func,
74647473
#if WASM_ENABLE_SHARED_MEMORY != 0
74657474
case WASM_OP_ATOMIC_PREFIX:
74667475
{
7467-
opcode = read_uint8(p);
7476+
uint32 opcode1;
7477+
7478+
read_leb_uint32(p, p_end, opcode1);
7479+
74687480
#if WASM_ENABLE_FAST_INTERP != 0
7469-
emit_byte(loader_ctx, opcode);
7481+
emit_byte(loader_ctx, opcode1);
74707482
#endif
7471-
if (opcode != WASM_OP_ATOMIC_FENCE) {
7483+
if (opcode1 != WASM_OP_ATOMIC_FENCE) {
74727484
CHECK_MEMORY();
74737485
read_leb_uint32(p, p_end, align); /* align */
74747486
read_leb_uint32(p, p_end, mem_offset); /* offset */
@@ -7479,7 +7491,7 @@ wasm_loader_prepare_bytecode(WASMModule *module, WASMFunction *func,
74797491
#if WASM_ENABLE_JIT != 0 || WASM_ENABLE_WAMR_COMPILER != 0
74807492
func->has_memory_operations = true;
74817493
#endif
7482-
switch (opcode) {
7494+
switch (opcode1) {
74837495
case WASM_OP_ATOMIC_NOTIFY:
74847496
POP2_AND_PUSH(VALUE_TYPE_I32, VALUE_TYPE_I32);
74857497
break;

‎wamr-compiler/main.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -627,8 +627,10 @@ main(int argc, char *argv[])
627627
goto fail1;
628628
}
629629

630-
if (get_package_type(wasm_file, wasm_file_size) != Wasm_Module_Bytecode) {
631-
printf("Invalid file type: expected wasm file but got other\n");
630+
if (wasm_file_size >= 4 /* length of MAGIC NUMBER */
631+
&& get_package_type(wasm_file, wasm_file_size)
632+
!= Wasm_Module_Bytecode) {
633+
printf("Invalid wasm file: magic header not detected\n");
632634
goto fail2;
633635
}
634636

0 commit comments

Comments
 (0)