From fd71c67747c3a85db9670a0d558670c4cb124c91 Mon Sep 17 00:00:00 2001
From: "Alon Zakai (kripken)" <alonzakai@gmail.com>
Date: Tue, 30 May 2017 19:55:40 -0700
Subject: handle out of range memory size values in s-expr parsing

---
 src/wasm/wasm-s-parser.cpp | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

(limited to 'src/wasm/wasm-s-parser.cpp')

diff --git a/src/wasm/wasm-s-parser.cpp b/src/wasm/wasm-s-parser.cpp
index 5ea8f2b0f..d3f411263 100644
--- a/src/wasm/wasm-s-parser.cpp
+++ b/src/wasm/wasm-s-parser.cpp
@@ -1460,7 +1460,11 @@ void SExpressionWasmBuilder::parseMemory(Element& s, bool preParseImport) {
       return;
     }
   }
-  wasm.memory.initial = atoi(s[i++]->c_str());
+  uint64_t num = atoi(s[i++]->c_str());
+  if (num > std::numeric_limits<Address::address_t>::max()) {
+    throw ParseException("excessive memory init", s.line, s.col);
+  }
+  wasm.memory.initial = num;
   if (i == s.size()) return;
   if (s[i]->isStr()) {
     uint64_t max = atoll(s[i]->c_str());
@@ -1475,7 +1479,11 @@ void SExpressionWasmBuilder::parseMemory(Element& s, bool preParseImport) {
     if (curr[0]->str() == DATA) {
       offsetValue = 0;
     } else {
-      offsetValue = atoi(curr[j++]->c_str());
+      uint64_t num = atoi(curr[j++]->c_str());
+      if (num > std::numeric_limits<Address::address_t>::max()) {
+        throw ParseException("excessive memory offset", s.line, s.col);
+      }
+      offsetValue = num;
     }
     const char *input = curr[j]->c_str();
     auto* offset = allocator.alloc<Const>();
-- 
cgit v1.2.3