ghidra-wasm-plugin icon indicating copy to clipboard operation
ghidra-wasm-plugin copied to clipboard

Fix Leb128 parsing of WasmLoader.

Open cmorin6 opened this issue 3 years ago • 0 comments

I encountered some wasm files that weren't loading properly due to Leb128 parsing. The current implementation tries parsing the vale from an array of 5 bytes then compute and consume the expected byte size from the reader. The issue came from Leb128 values that where padded with null bytes (probably as some anti-reversing technique) causing the parsing size and consumed size to differ, leading to a misaligned parsing of the following structures and a failure to load the wasm file.

Example: e2 81 80 80 00 and e2 01 are both "valid" representation of the value 226 in LEB128

I opted to reuse the LEB128 utility already present in Ghidra for the Dwarf parsing that didn't suffer from this issue.

cmorin6 avatar Aug 23 '21 12:08 cmorin6