wasm3 icon indicating copy to clipboard operation
wasm3 copied to clipboard

Missing Bounds Validation for Element Section

Open Q1IQ opened this issue 1 year ago • 0 comments

Description

Wasm3 does not correctly validate the size of the element section against the available table size in a WebAssembly module. This behavior violates the WebAssembly specification, which mandates that the element section should not exceed the size of the defined table.

Environment

$ ./wasm3 --version
Wasm3 v0.5.1 on x86_64
Build: Jan  3 2025 16:24:40, Ubuntu Clang 20.0.0 (++20241027052758+e33aec89ef13-1~exp1~20241027172907.1199)

Steps to Reproduce

Run the following WebAssembly module:

(module
  (func (export "main") (result i32)
    i32.const 1
  )
  (elem (i32.const 0) funcref (ref.func 0) (ref.func 0))
)

program.wasm.txt

Output

wasm3 --func main /path/to/test/program.wasm
Result: 1

Expected Behavior

According to the WebAssembly specification, the element section must not exceed the bounds of the available table. If it does, the module should fail validation with an error message similar to:

Element section for Table 0 exceeds available Table 0

Q1IQ avatar Jan 03 '25 08:01 Q1IQ