wasm3 icon indicating copy to clipboard operation
wasm3 copied to clipboard

Missing Callee Type Checking in call and call_indirect Instructions

Open Q1IQ opened this issue 1 year ago • 1 comments

Description

Wasm3 fails to validate callee parameter types in call and call_indirect instructions, violating the WebAssembly specification. This allows mismatched argument types to bypass validation, leading to incorrect behavior.

Environment

$ ./wasm3 --version
Wasm3 v0.5.0 on x86_64
Build: May 28 2024 20:38:13, Ubuntu Clang 19.0.0

Steps to reproduce

Run the following wasm module:

(module
  (type (func (param i32 i32) (result i32)))

  (func $func1 (type 0) (param i32 i32) (result i32)
    local.get 0
    local.get 1
    i32.add)

  (func $func2 (type 0) (param i32 i32) (result i32)
    local.get 0
    local.get 1
    i32.sub)

  (table 2 funcref)
  (elem (i32.const 0) $func1 $func2)

  (func $main (result i32 i32)
    i64.const 0x1234123412341234
    i32.const 0x1234
    call $func1 
    i64.const 0x1234123412341234
    i32.const 0x1234
    i32.const 1
    call_indirect (type 0)
    )
        

  (export "main" (func $main))
)

Output:

wasm3 --func main /hdd3/qqspace/test/program.wasm
Result: 305407080
Result: 305397760

Expected behavior

The $func1 and $func2 expects two i32 parameters. The $main function passes an i64 and an i32. Per WebAssembly validation rules, the arguments must match the callee's signature.

Q1IQ avatar Dec 18 '24 07:12 Q1IQ

Please note the pinned issue: https://github.com/wasm3/wasm3/issues/344

igrr avatar Dec 18 '24 08:12 igrr