stacks-network / clarity-wasm

`clar2wasm` is a compiler for generating WebAssembly from Clarity.
GNU General Public License v3.0
14 stars 16 forks source link

Wrong handling of allocated memory in `map` #563

Open Acaccia opened 6 days ago

Acaccia commented 6 days ago

The map function will allocate enough memory for the result of the computation: https://github.com/stacks-network/clarity-wasm/blob/053db35fe18d0804786fc51a56a50490ac4db788/clar2wasm/src/words/sequences.rs#L683

However, when we call the function, its result will be written to some place in memory, and then the pointer toward it will be inserted in the memory allocated by map. So, out of all the allocated memory, we will store only the pointers to the elements there. The elements will remain in other places in memory, and the allocated space will, in the end, remain mostly empty.

This can lead to memory-out-of-bounds issues since the elements that are not copied to the allocated space will occupy the memory and might fill it up if there are enough of them.