WasmEdge icon indicating copy to clipboard operation
WasmEdge copied to clipboard

fuzz: Wasmedge had an error executing this wasm binary, but not in other runtimes.

Open abc767234318 opened this issue 1 year ago • 1 comments

Description

I constructed a wasm binary with an exported function called "main". I compared the outputs of WasmEdge with other runtimes. file65.zip

The outputs of WasmEdge are as follows:

[2023-09-17 19:43:57.639] [error] execution failed: out of bounds memory access, Code: 0x88
[2023-09-17 19:43:57.639] [error]     Accessing offset from: 0x100001cc6 to: 0x100001ccd , Out of boundary: 0xffffffff
[2023-09-17 19:43:57.639] [error]     In instruction: v128.load64_splat (0xfd 0x0a) , Bytecode offset: 0x0000027c
[2023-09-17 19:43:57.639] [error]     When executing function name: "main"

While the outputs of the other runtimes like wasmtime and wasmer are:

-----------------wasmtime-----------------
warning: using `--invoke` with a function that returns values is experimental and may break in the future
345815071808
345815071808
345815071808
345815071808

-----------------wasmer-----------------
345815071808 345815071808 345815071808 345815071808

abc767234318 avatar Sep 17 '23 13:09 abc767234318

Tested with WasmEdge 0.14.0-rc.4 (both MacOS arm64 and ubuntu 22.04 x86_64):

# Interpreter
$ ./wasmedge --reactor issue2814.wasm main
[2024-04-12 10:08:38.773] [error] execution failed: out of bounds memory access, Code: 0x408
[2024-04-12 10:08:38.775] [error]     Accessing offset from: 0x100001cc6 to: 0x100001ccd , Out of boundary: 0xffffffff
[2024-04-12 10:08:38.775] [error]     In instruction: v128.load64_splat (0xfd 0x0a) , Bytecode offset: 0x0000027c
[2024-04-12 10:08:38.775] [error]     When executing function name: "main"

# AOT
$ ./wasmedgec issue2814.wasm issue2814_aot.wasm
[2024-04-12 10:08:59.708] [info] compile start
[2024-04-12 10:08:59.738] [info] verify start
[2024-04-12 10:08:59.745] [info] optimize start
[2024-04-12 10:08:59.924] [info] optimize done
[2024-04-12 10:08:59.925] [info] codegen start
[2024-04-12 10:09:00.167] [info] output start
[2024-04-12 10:09:00.231] [info] codegen done
[2024-04-12 10:09:00.235] [info] output start
[2024-04-12 10:09:00.237] [info] output done

$ ./wasmedge --reactor issue2814_aot.wasm main
[2024-04-12 10:09:20.820] [error] execution failed: out of bounds memory access, Code: 0x408
[2024-04-12 10:09:20.822] [error]     When executing function name: "main"

Wasmtime v17.0.3 MacOS arm64:

$ ./wasmtime --invoke main issue2814.wasm
Error: failed to run main module `issue2814.wasm`

Caused by:
    0: failed to invoke `main`
    1: error while executing at wasm backtrace:
           0:  0x27c - <unknown>!<wasm function 2>
    2: memory fault at wasm address 0x100001cc6 in linear memory of size 0x100000000
    3: wasm trap: out of bounds memory access

Wasmtime v17.0.3 Ubuntu22.04 x86_64:

$ ./wasmtime --invoke main issue2814.wasm
warning: using `--invoke` with a function that returns values is experimental and may break in the future
345815071808
345815071808
345815071808
345815071808

Wasmer v4.2.8 MacOS arm64:

$ ./wasmer -e main issue2814.wasm
error: RuntimeError: out of bounds memory access

Wasmer v4.2.8 Ubuntu 22.04 x86_64:

$ ./wasmer -e main issue2814.wasm
345815071808 345815071808 345815071808 345815071808

It seems like the other runtimes output the wrong result.

cc @hydai

q82419 avatar Apr 12 '24 10:04 q82419

Close this issue and redirect to #3001.

q82419 avatar May 10 '24 05:05 q82419