Browse Source

LibWasm: Limit the number of function locals

It's possible for the module to request too many locals, we now reject
such modules instead of trying to allocate space for them.
The value itself is chosen arbitrarily, so future tweaks _might_ be
necessary.
Found by OSS-Fuzz: https://oss-fuzz.com/testcase?key=4755809098661888
Ali Mohammad Pur 3 years ago
parent
commit
b64d6bb3a3

+ 1 - 0
Userland/Libraries/LibWasm/Constants.h

@@ -40,5 +40,6 @@ static constexpr auto page_size = 64 * KiB;
 // These are not concretely defined by the spec, so the values are only defined by us.
 // These are not concretely defined by the spec, so the values are only defined by us.
 static constexpr auto minimum_stack_space_to_keep_free = 256 * KiB; // Note: Value is arbitrary and chosen by testing with ASAN
 static constexpr auto minimum_stack_space_to_keep_free = 256 * KiB; // Note: Value is arbitrary and chosen by testing with ASAN
 static constexpr auto max_allowed_executed_instructions_per_call = 256 * 1024 * 1024;
 static constexpr auto max_allowed_executed_instructions_per_call = 256 * 1024 * 1024;
+static constexpr auto max_allowed_function_locals_per_type = 420; // Note: VERY arbitrary.
 
 
 }
 }

+ 4 - 1
Userland/Libraries/LibWasm/Parser/Parser.cpp

@@ -1091,7 +1091,10 @@ ParseResult<Locals> Locals::parse(InputStream& stream)
     size_t count;
     size_t count;
     if (!LEB128::read_unsigned(stream, count))
     if (!LEB128::read_unsigned(stream, count))
         return with_eof_check(stream, ParseError::InvalidSize);
         return with_eof_check(stream, ParseError::InvalidSize);
-    // TODO: Disallow too many entries.
+
+    if (count > Constants::max_allowed_function_locals_per_type)
+        return with_eof_check(stream, ParseError::HugeAllocationRequested);
+
     auto type = ValueType::parse(stream);
     auto type = ValueType::parse(stream);
     if (type.is_error())
     if (type.is_error())
         return type.error();
         return type.error();