Commit 11602da
authored
Fix out-of-bounds type stack read after rethrow in c-writer (#2798)
wasm2c on a valid exceptions module, ASan/debug build:
Assertion failed: (index < type_stack_.size()), function Write, file
c-writer.cc, line 1246.
Worked backwards from the StackVar read. The rethrow case in
`Write(const ExprList&)` ends in `break`, so the loop carries on and
emits the instructions after it. The validator has already marked those
unreachable (`OnRethrow` makes the stack polymorphic), so a valid module
can put operations there that pop operands which are not really on the
stack. StackVar then underflows `type_stack_` and reads off the end.
Release builds drop the assert and take the out-of-bounds read;
`DropTypes` does an out-of-bounds erase on the same tail.
br, br_table, return, unreachable, throw, throw_ref and the return_call
family all return here to stop walking the list. rethrow was the one
that fell through, so it now does the same.
Repro: `(func try nop catch_all rethrow 0 i32.store end)` assembled with
`--enable-exceptions`, then run through wasm2c.1 parent f794a59 commit 11602da
2 files changed
Lines changed: 18 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
4187 | 4187 | | |
4188 | 4188 | | |
4189 | 4189 | | |
4190 | | - | |
| 4190 | + | |
| 4191 | + | |
| 4192 | + | |
4191 | 4193 | | |
4192 | 4194 | | |
4193 | 4195 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
0 commit comments