wasm3
wasm3 copied to clipboard
Missing Callee Type Checking in call and call_indirect Instructions
Description
Wasm3 fails to validate callee parameter types in call and call_indirect instructions, violating the WebAssembly specification. This allows mismatched argument types to bypass validation, leading to incorrect behavior.
Environment
$ ./wasm3 --version
Wasm3 v0.5.0 on x86_64
Build: May 28 2024 20:38:13, Ubuntu Clang 19.0.0
Steps to reproduce
Run the following wasm module:
(module
(type (func (param i32 i32) (result i32)))
(func $func1 (type 0) (param i32 i32) (result i32)
local.get 0
local.get 1
i32.add)
(func $func2 (type 0) (param i32 i32) (result i32)
local.get 0
local.get 1
i32.sub)
(table 2 funcref)
(elem (i32.const 0) $func1 $func2)
(func $main (result i32 i32)
i64.const 0x1234123412341234
i32.const 0x1234
call $func1
i64.const 0x1234123412341234
i32.const 0x1234
i32.const 1
call_indirect (type 0)
)
(export "main" (func $main))
)
Output:
wasm3 --func main /hdd3/qqspace/test/program.wasm
Result: 305407080
Result: 305397760
Expected behavior
The $func1 and $func2 expects two i32 parameters. The $main function passes an i64 and an i32. Per WebAssembly validation rules, the arguments must match the callee's signature.
Please note the pinned issue: https://github.com/wasm3/wasm3/issues/344