search

Samsung / walrus

WebAssembly Lightweight RUntime
Apache License 2.0
39 stars 10 forks source link

Fix fusion of 64 bit compare with select on 32 bit #214

Closed ghost closed 9 months ago

ghost commented 9 months ago

Discovered by @zherczeg . Previously emitSelect would crash in an ASSERT when checking the instruction count.

I am a bit wary of the emit* instructions not actually checking whether they are being called on the right instruction class, if select had the same number of operands as one of the comparison instructions, the assert would not have caught it, and the reinterpret_cast would have been called on the select. That is probably not a serious enough bug to cause a sandbox escape, but it could result in arbitrary reads within the module memory. At the very least it could lead to data corruption bugs that would be hard to track down.

zherczeg commented 9 months ago

Is this a duplication of #210 ?

ghost commented 9 months ago

Is this a duplication of #210 ?

Yup, it wasn't yet in main when I wrote this and I glossed over the other PR.