diff options
author | Ben Smith <binji@chromium.org> | 2020-04-29 00:31:05 -0700 |
---|---|---|
committer | GitHub <noreply@github.com> | 2020-04-29 00:31:05 -0700 |
commit | 5c48f3bdd5ab8b7c27d4959840407ce09a31f0cf (patch) | |
tree | d2fbed7750e031ff04070843eb94f58338aad8c8 /src | |
parent | 5e16bf1c7ef1d2bed53db4e5a03771d2d5a12f04 (diff) | |
download | wabt-5c48f3bdd5ab8b7c27d4959840407ce09a31f0cf.tar.gz wabt-5c48f3bdd5ab8b7c27d4959840407ce09a31f0cf.tar.bz2 wabt-5c48f3bdd5ab8b7c27d4959840407ce09a31f0cf.zip |
Fix address overflow bug in wasm2c (#1401)
This only occurs when the immediate offset is small (`int` sized). The
stack offset is `u32` and the immediate is an `int`, so the usual
arithmetic conversions converts the result to a `u32`, which wraps the
address before checking for overflow.
There are already spec tests for overflow, but these use an offset of
`4294967295`, which is `long` (at least on LP64 systems). This means
that the sum's type is `u32 + long` which is `long`. This is why the
tests pass. I've added additional tests for these cases here:
https://github.com/WebAssembly/spec/pull/1188
This fixes issue #1400.
Diffstat (limited to 'src')
-rw-r--r-- | src/c-writer.cc | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/src/c-writer.cc b/src/c-writer.cc index 98a683c6..ba7e5c4a 100644 --- a/src/c-writer.cc +++ b/src/c-writer.cc @@ -2080,10 +2080,10 @@ void CWriter::Write(const LoadExpr& expr) { Type result_type = expr.opcode.GetResultType(); Write(StackVar(0, result_type), " = ", func, "(", ExternalPtr(memory->name), - ", (u64)(", StackVar(0)); + ", (u64)(", StackVar(0), ")"); if (expr.offset != 0) - Write(" + ", expr.offset); - Write("));", Newline()); + Write(" + ", expr.offset, "u"); + Write(");", Newline()); DropTypes(1); PushType(result_type); } @@ -2108,10 +2108,10 @@ void CWriter::Write(const StoreExpr& expr) { assert(module_->memories.size() == 1); Memory* memory = module_->memories[0]; - Write(func, "(", ExternalPtr(memory->name), ", (u64)(", StackVar(1)); + Write(func, "(", ExternalPtr(memory->name), ", (u64)(", StackVar(1), ")"); if (expr.offset != 0) Write(" + ", expr.offset); - Write("), ", StackVar(0), ");", Newline()); + Write(", ", StackVar(0), ");", Newline()); DropTypes(2); } |