Prevent an integer overflow when checking start_func_index

bytecodealliance / wasm-micro-runtime

WebAssembly Micro Runtime (WAMR)

Apache License 2.0

4.84k stars 618 forks source link

Prevent an integer overflow when checking start_func_index #3577

Closed lum1n0us closed 3 months ago

lum1n0us commented 3 months ago

69920

yamt commented 3 months ago

btw, does it make much sense to perform fuzzing on the aot loader? (i guess it's what you are doing. this is just a guess because i have no access to the given oss-fuzz url.) unlike wasm modules, we somehow need to trust aot modules in some extent anyway.

lum1n0us commented 3 months ago

wamr in oss-fuzz

It is a problem. We're kind of hesitant to do that(fix aot related problems).

We do need to trust aot modules but also want to robust(for aot_loader) and protection(since there is no case for wamrc currently). So, we are using a "better than nothing" policy until figure it out clearly.

lum1n0us commented 3 months ago

Use https://github.com/bytecodealliance/wasm-micro-runtime/pull/3579 to fix