Missing Type Validation in call_indirect Instruction, causing segmentation fault

[Q1IQ]

iwasm fails to validate the function signature in call_indirect, potentially causing a segmentation fault at runtime. This violates the WebAssembly specification, which mandates signature checking for indirect calls.

Test case

program.wat.txt
program.wasm.txt

Your environment

• OS: Ubuntu 20.04
• CPU: amd64
• WAMR version: iwasm 2.2.0
• Commands:

iwasm --interp -f main ./program.wasm

Actual behavior

Aborted (core dumped)

Expected State

expected signature type

[Septa2112]

I’ve downloaded your file and switched to wamr-2.2.0, but I wasn’t able to reproduce the issue on my side. Could you please share more detailed steps to reproduce it, along with any additional information that might help?

[Q1IQ]

Thanks for checking. Here are my build options, in case they help reproduce the issue on your side:

"camke",
        "-DCMAKE_BUILD_TYPE=Debug",
        "-DWAMR_BUILD_INTERP=1",
        "-DWAMR_BUILD_AOT=0",                 
        "-DWAMR_BUILD_JIT=0",                  
        "-DWAMR_BUILD_FAST_JIT=0",             
        "-DWAMR_BUILD_LIBC_BUILTIN=1", 
        "-DWAMR_BUILD_LIBC_WASI=1",
        "-DWAMR_BUILD_FAST_INTERP=1",
        "-DWAMR_BUILD_MULTI_MODULE=1",
        "-DWAMR_BUILD_BULK_MEMORY=1",
        "-DWAMR_BUILD_REF_TYPES=1",
        "-DWAMR_BUILD_SIMD=1",
        "-DWAMR_BUILD_TAIL_CALL=1",
        "-DWAMR_BUILD_SHARED_MEMORY=1",
        "-DWAMR_BUILD_THREAD_MGR=1",
        "-DWAMR_BUILD_EXCEPTION_HANDLING=1",
        "-DWAMR_BUILD_GC=1",
        "-DWAMR_BUILD_FUNCTION_REFERENCES=1",
        "-DWAMR_BUILD_EXTENDED_CONST=1",
        "-DWAMR_BUILD_MEMORY64=1",
        "-DWAMR_BUILD_DEBUG_INTERP=1",
        "-DWAMR_BUILD_DUMP_CALL_STACK=1",
        "-DWAMR_BUILD_PERF_PROFILING=1",
        "-DWAMR_BUILD_LOAD_CUSTOM_SECTION=1",
        "-DWAMR_BUILD_MINI_LOADER=1",
        "-DCMAKE_C_FLAGS='-g3 -O0 -DDEBUG -fno-omit-frame-pointer'",
        "-DCMAKE_CXX_FLAGS='-g3 -O0 -DDEBUG -fno-omit-frame-pointer'",
        ".."
"make"

[Septa2112]

I tested this on wamr-2.2.0 and found that the core dump was caused by the -DWAMR_BUILD_GC=1 option. This issue has been fixed in wamr-2.3.1. If you want to avoid this problem, I recommend using WAMR version 2.3.1 or later.