@@ -323,7 +323,13 @@ wasm_runtime_atomic_wait(WASMModuleInstanceCommon *module, void *address,
323323 WASMModuleInstance * module_inst = (WASMModuleInstance * )module ;
324324 /* Currently we have only one memory instance */
325325 if (!module_inst -> memories [0 ]-> is_shared ) {
326- wasm_runtime_set_exception (module , "wait on unshared memory" );
326+ wasm_runtime_set_exception (module , "expected shared memory" );
327+ return -1 ;
328+ }
329+ if ((uint8 * )address < module_inst -> memories [0 ]-> memory_data
330+ || (uint8 * )address + (wait64 ? 8 : 4 )
331+ > module_inst -> memories [0 ]-> memory_data_end ) {
332+ wasm_runtime_set_exception (module , "out of bounds memory access" );
327333 return -1 ;
328334 }
329335 }
@@ -335,7 +341,13 @@ wasm_runtime_atomic_wait(WASMModuleInstanceCommon *module, void *address,
335341 ((AOTMemoryInstance * * )aot_inst -> memories .ptr )[0 ];
336342 /* Currently we have only one memory instance */
337343 if (!aot_memory -> is_shared ) {
338- wasm_runtime_set_exception (module , "wait on unshared memory" );
344+ wasm_runtime_set_exception (module , "expected shared memory" );
345+ return -1 ;
346+ }
347+ if ((uint8 * )address < (uint8 * )aot_memory -> memory_data .ptr
348+ || (uint8 * )address + (wait64 ? 8 : 4 )
349+ > (uint8 * )aot_memory -> memory_data_end .ptr ) {
350+ wasm_runtime_set_exception (module , "out of bounds memory access" );
339351 return -1 ;
340352 }
341353 }
@@ -424,6 +436,31 @@ wasm_runtime_atomic_notify(WASMModuleInstanceCommon *module, void *address,
424436 uint32 notify_result ;
425437 AtomicWaitInfo * wait_info ;
426438
439+ #if WASM_ENABLE_INTERP != 0
440+ if (module -> module_type == Wasm_Module_Bytecode ) {
441+ WASMModuleInstance * module_inst = (WASMModuleInstance * )module ;
442+ if ((uint8 * )address < module_inst -> memories [0 ]-> memory_data
443+ || (uint8 * )address + 4
444+ > module_inst -> memories [0 ]-> memory_data_end ) {
445+ wasm_runtime_set_exception (module , "out of bounds memory access" );
446+ return -1 ;
447+ }
448+ }
449+ #endif
450+ #if WASM_ENABLE_AOT != 0
451+ if (module -> module_type == Wasm_Module_AoT ) {
452+ AOTModuleInstance * aot_inst = (AOTModuleInstance * )module ;
453+ AOTMemoryInstance * aot_memory =
454+ ((AOTMemoryInstance * * )aot_inst -> memories .ptr )[0 ];
455+ if ((uint8 * )address < (uint8 * )aot_memory -> memory_data .ptr
456+ || (uint8 * )address + 4
457+ > (uint8 * )aot_memory -> memory_data_end .ptr ) {
458+ wasm_runtime_set_exception (module , "out of bounds memory access" );
459+ return -1 ;
460+ }
461+ }
462+ #endif
463+
427464 wait_info = acquire_wait_info (address , false);
428465
429466 /* Nobody wait on this address */
0 commit comments