Out-of-bound Read at `BinaryReaderInterp::OnReturnCallIndirectExpr`

[Mem2019]

trafficstars

Commit: 83a226bcd1816c86fb1fcb0963c6a11e2c373aaf

Reproduce

Sample: interp_sig_index_oob.zip

./wasm-objdump -d interp_sig_index_oob.wasm
./wasm-interp --enable-tail-call interp_sig_index_oob.wasm

Output:

interp_sig_index_oob.wasm:  file format wasm 0x1

Code Disassembly:

000063 func[0] <_start>:
 000064: 01 7c                      | local[0] type=f64
 000066: 01 7d                      | local[1] type=f32
 000068: 01 7e                      | local[2] type=i64
 00006a: 01 7f                      | local[3] type=i32
 00006c: 13 13 13                   | return_call_indirect 19 19
 
 
=================================================================
==4201==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060000008b8 at pc 0x559d6f7da883 bp 0x7ffd3d189f90 sp 0x7ffd3d189f80
READ of size 8 at 0x6060000008b8 thread T0
    #0 0x559d6f7da882 in std::vector<wabt::Type, std::allocator<wabt::Type> >::size() const /usr/include/c++/9/bits/stl_vector.h:916
    #1 0x559d6f823a4a in GetReturnCallDropKeepCount /wabt/src/interp/binary-reader-interp.cc:438
    #2 0x559d6f8360be in OnReturnCallIndirectExpr /wabt/src/interp/binary-reader-interp.cc:1146
    #3 0x559d6f935ab9 in ReadInstructions /wabt/src/binary-reader.cc:879
    #4 0x559d6f92de6d in ReadFunctionBody /wabt/src/binary-reader.cc:609
    #5 0x559d6f95d8d3 in ReadCodeSection /wabt/src/binary-reader.cc:2731
    #6 0x559d6f960d23 in ReadSections /wabt/src/binary-reader.cc:2885
    #7 0x559d6f961b6e in ReadModule /wabt/src/binary-reader.cc:2946
    #8 0x559d6f9620fd in wabt::ReadBinary(void const*, unsigned long, wabt::BinaryReaderDelegate*, wabt::ReadBinaryOptions const&) /wabt/src/binary-reader.cc:2964
    #9 0x559d6f8424a8 in wabt::interp::ReadBinaryInterp(std::basic_string_view<char, std::char_traits<char> >, void const*, unsigned long, wabt::ReadBinaryOptions const&, std::vector<wabt::Error, std::allocator<wabt::Error> >*, wabt::interp::ModuleDesc*) /wabt/src/interp/binary-reader-interp.cc:1544
    #10 0x559d6f7ca861 in ReadModule /wabt/src/tools/wasm-interp.cc:207
    #11 0x559d6f7cb0f9 in ReadAndRunModule /wabt/src/tools/wasm-interp.cc:234
    #12 0x559d6f7cb6e1 in ProgramMain(int, char**) /wabt/src/tools/wasm-interp.cc:329
    #13 0x559d6f7cb793 in main /wabt/src/tools/wasm-interp.cc:335
    #14 0x7f56dde380b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #15 0x559d6f7c81bd in _start (/wabt/build/wasm-interp+0x1541bd)

Address 0x6060000008b8 is a wild pointer.
SUMMARY: AddressSanitizer: heap-buffer-overflow /usr/include/c++/9/bits/stl_vector.h:916 in std::vector<wabt::Type, std::allocator<wabt::Type> >::size() const
Shadow bytes around the buggy address:
  0x0c0c7fff80c0: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa
  0x0c0c7fff80d0: fd fd fd fd fd fd fd fd fa fa fa fa 00 00 00 00
  0x0c0c7fff80e0: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c0c7fff80f0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
  0x0c0c7fff8100: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
=>0x0c0c7fff8110: fa fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa fa
  0x0c0c7fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==4201==ABORTING
Aborted

Analysis

The OOB occurs at when sig_index is used to access module_.func_types vector.

Variable sig_index is read directly from input as U32Leb128 form, so this value can be completely controlled by attacker.

Possible Fix

Add a check before accessing the vector, just like other handlers, for example. It seems that there is a check for this handler but too late. The comment says "The validator must be run after we get the drop/keep counts, since it changes the type stack.", so maybe we can separate the index check before vector access since checking index does not change any "type stack".

[Mem2019]

In addtion, it seems that there is a similar OOB read at BinaryReaderInterp::OnReturnCallExpr

[sbc100]

Sadly we don't have a lot of resource to dedicate to fixing such issues. I have a backlog of similar issues but it has not been possible to dedicate time to fix them yet.

I appreciate you filling such issues though, and if you have time to create PRs to them they would certainly be welcome.