Skip to content

Fix potential pointer overflows #826

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 15, 2021
Merged

Fix potential pointer overflows #826

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fe4c07c
Merge pull request #387 from bytecodealliance/main
wenyongh Nov 10, 2021
3b5b9a0
Fix potential pointer overflows
wenyongh Nov 10, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions core/iwasm/aot/aot_loader.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2038,7 +2038,8 @@ load_relocation_section(const uint8 *buf, const uint8 *buf_end,

for (j = 0; j < relocation_count; j++) {
AOTRelocation relocation = { 0 };
uint32 symbol_index, offset32, addend32;
uint32 symbol_index, offset32;
int32 addend32;
uint16 symbol_name_len;
uint8 *symbol_name;

Expand All @@ -2050,7 +2051,7 @@ load_relocation_section(const uint8 *buf, const uint8 *buf_end,
read_uint32(buf, buf_end, offset32);
relocation.relocation_offset = (uint64)offset32;
read_uint32(buf, buf_end, addend32);
relocation.relocation_addend = (uint64)addend32;
relocation.relocation_addend = (int64)addend32;
}
read_uint32(buf, buf_end, relocation.relocation_type);
read_uint32(buf, buf_end, symbol_index);
Expand Down
2 changes: 1 addition & 1 deletion core/iwasm/aot/aot_reloc.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,7 @@ get_current_target(char *target_buf, uint32 target_buf_size);
bool
apply_relocation(AOTModule *module,
uint8 *target_section_addr, uint32 target_section_size,
uint64 reloc_offset, uint64 reloc_addend,
uint64 reloc_offset, int64 reloc_addend,
uint32 reloc_type, void *symbol_addr, int32 symbol_index,
char *error_buf, uint32 error_buf_size);
/* clang-format off */
Expand Down
2 changes: 1 addition & 1 deletion core/iwasm/aot/aot_runtime.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2087,7 +2087,7 @@ aot_enlarge_memory(AOTModuleInstance *module_inst, uint32 inc_page_count)
}
}

heap_data = heap_data_old + (memory_data - memory_data_old);
heap_data = memory_data + (heap_data_old - memory_data_old);
memory_inst->heap_data.ptr = heap_data;
memory_inst->heap_data_end.ptr = heap_data + heap_size;

Expand Down
2 changes: 1 addition & 1 deletion core/iwasm/aot/aot_runtime.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ typedef struct AOTObjectDataSection {
/* Relocation info */
typedef struct AOTRelocation {
uint64 relocation_offset;
uint64 relocation_addend;
int64 relocation_addend;
uint32 relocation_type;
char *symbol_name;
/* index in the symbol offset field */
Expand Down
2 changes: 1 addition & 1 deletion core/iwasm/aot/arch/aot_reloc_aarch64.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ check_reloc_offset(uint32 target_section_size, uint64 reloc_offset,
bool
apply_relocation(AOTModule *module, uint8 *target_section_addr,
uint32 target_section_size, uint64 reloc_offset,
uint64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int32 symbol_index, char *error_buf, uint32 error_buf_size)
{
switch (reloc_type) {
Expand Down
9 changes: 5 additions & 4 deletions core/iwasm/aot/arch/aot_reloc_arc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,15 +164,16 @@ middle_endian_convert(uint32 insn)
bool
apply_relocation(AOTModule *module, uint8 *target_section_addr,
uint32 target_section_size, uint64 reloc_offset,
uint64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int32 symbol_index, char *error_buf, uint32 error_buf_size)
{
switch (reloc_type) {
case R_ARC_S25W_PCREL:
{
uint32 insn = LOAD_I32(target_section_addr + reloc_offset);
int32 addend, value;
uintptr_t S, A, P;
uintptr_t S, P;
intptr_t A;

CHECK_RELOC_OFFSET(sizeof(void *));

Expand All @@ -190,7 +191,7 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,

/* (S + A) - P */
S = (uintptr_t)(uint8 *)symbol_addr;
A = (uintptr_t)reloc_addend;
A = (intptr_t)reloc_addend;
P = (uintptr_t)(target_section_addr + reloc_offset);
P &= (uintptr_t)~3;
value = (int32)(S + A + addend - P);
Expand All @@ -214,7 +215,7 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,
CHECK_RELOC_OFFSET(sizeof(void *));

/* (S + A) */
insn = (uint32)(uintptr_t)((uint8 *)symbol_addr + reloc_addend);
insn = (uint32)((uintptr_t)symbol_addr + (intptr_t)reloc_addend);

if (reloc_type == R_ARC_32_ME)
/* Convert to middle endian */
Expand Down
18 changes: 11 additions & 7 deletions core/iwasm/aot/arch/aot_reloc_arm.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,7 +197,7 @@ check_reloc_offset(uint32 target_section_size, uint64 reloc_offset,
bool
apply_relocation(AOTModule *module, uint8 *target_section_addr,
uint32 target_section_size, uint64 reloc_offset,
uint64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int32 symbol_index, char *error_buf, uint32 error_buf_size)
{
switch (reloc_type) {
Expand All @@ -221,8 +221,10 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,
*/
/* operation: ((S + A) | T) - P where S is symbol address and T
* is 0 */
result = (intptr_t)((uint8 *)symbol_addr + reloc_addend
- (target_section_addr + reloc_offset));
result =
(intptr_t)((uintptr_t)symbol_addr + (intptr_t)reloc_addend
- (uintptr_t)(target_section_addr
+ reloc_offset));
}
else {
if (reloc_addend > 0) {
Expand All @@ -243,8 +245,9 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,
uint8 *plt = (uint8 *)module->code + module->code_size
- get_plt_table_size()
+ get_plt_item_size() * symbol_index;
result = (intptr_t)(plt + reloc_addend
- (target_section_addr + reloc_offset));
result = (intptr_t)((uintptr_t)plt + (intptr_t)reloc_addend
- (uintptr_t)(target_section_addr
+ reloc_offset));
}

result += initial_addend;
Expand All @@ -269,8 +272,9 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,
CHECK_RELOC_OFFSET(sizeof(void *));
initial_addend =
*(intptr_t *)(target_section_addr + (uint32)reloc_offset);
*(uint8 **)(target_section_addr + reloc_offset) =
(uint8 *)symbol_addr + initial_addend + reloc_addend;
*(uintptr_t *)(target_section_addr + reloc_offset) =
(uintptr_t)symbol_addr + initial_addend
+ (intptr_t)reloc_addend;
break;
}

Expand Down
2 changes: 1 addition & 1 deletion core/iwasm/aot/arch/aot_reloc_mips.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ get_plt_table_size()
bool
apply_relocation(AOTModule *module, uint8 *target_section_addr,
uint32 target_section_size, uint64 reloc_offset,
uint64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int32 symbol_index, char *error_buf, uint32 error_buf_size)
{
switch (reloc_type) {
Expand Down
20 changes: 10 additions & 10 deletions core/iwasm/aot/arch/aot_reloc_riscv.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,7 +205,7 @@ check_reloc_offset(uint32 target_section_size, uint64 reloc_offset,
bool
apply_relocation(AOTModule *module, uint8 *target_section_addr,
uint32 target_section_size, uint64 reloc_offset,
uint64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int32 symbol_index, char *error_buf, uint32 error_buf_size)
{
int32 val, imm_hi, imm_lo, insn;
Expand All @@ -216,10 +216,10 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,
case R_RISCV_32:
{
uint32 val_32 =
(uint32)(uintptr_t)((uint8 *)symbol_addr + reloc_addend);
(uint32)((uintptr_t)symbol_addr + (intptr_t)reloc_addend);

CHECK_RELOC_OFFSET(sizeof(uint32));
if (val_32 != (uintptr_t)((uint8 *)symbol_addr + reloc_addend)) {
if (val_32 != ((uintptr_t)symbol_addr + (intptr_t)reloc_addend)) {
goto fail_addr_out_of_range;
}

Expand All @@ -229,7 +229,7 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,
case R_RISCV_64:
{
uint64 val_64 =
(uint64)(uintptr_t)((uint8 *)symbol_addr + reloc_addend);
(uint64)((uintptr_t)symbol_addr + (intptr_t)reloc_addend);
CHECK_RELOC_OFFSET(sizeof(uint64));
bh_memcpy_s(addr, 8, &val_64, 8);
break;
Expand Down Expand Up @@ -273,10 +273,10 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,

case R_RISCV_HI20:
{
val = (int32)(intptr_t)((uint8 *)symbol_addr + reloc_addend);
val = (int32)((intptr_t)symbol_addr + (intptr_t)reloc_addend);

CHECK_RELOC_OFFSET(sizeof(uint32));
if (val != (intptr_t)((uint8 *)symbol_addr + reloc_addend)) {
if (val != ((intptr_t)symbol_addr + (intptr_t)reloc_addend)) {
goto fail_addr_out_of_range;
}

Expand All @@ -290,10 +290,10 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,

case R_RISCV_LO12_I:
{
val = (int32)(intptr_t)((uint8 *)symbol_addr + reloc_addend);
val = (int32)((intptr_t)symbol_addr + (intptr_t)reloc_addend);

CHECK_RELOC_OFFSET(sizeof(uint32));
if (val != (intptr_t)((uint8 *)symbol_addr + reloc_addend)) {
if (val != (intptr_t)symbol_addr + (intptr_t)reloc_addend) {
goto fail_addr_out_of_range;
}

Expand All @@ -307,10 +307,10 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,

case R_RISCV_LO12_S:
{
val = (int32)(intptr_t)((uint8 *)symbol_addr + reloc_addend);
val = (int32)((intptr_t)symbol_addr + (intptr_t)reloc_addend);

CHECK_RELOC_OFFSET(sizeof(uint32));
if (val != (intptr_t)((uint8 *)symbol_addr + reloc_addend)) {
if (val != ((intptr_t)symbol_addr + (intptr_t)reloc_addend)) {
goto fail_addr_out_of_range;
}

Expand Down
5 changes: 3 additions & 2 deletions core/iwasm/aot/arch/aot_reloc_thumb.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,7 +238,7 @@ check_reloc_offset(uint32 target_section_size, uint64 reloc_offset,
bool
apply_relocation(AOTModule *module, uint8 *target_section_addr,
uint32 target_section_size, uint64 reloc_offset,
uint64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int32 symbol_index, char *error_buf, uint32 error_buf_size)
{
switch (reloc_type) {
Expand Down Expand Up @@ -269,7 +269,8 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,
/* operation: ((S + A) | T) - P where S is symbol address
and T is 1 */
result =
(int32)(((intptr_t)((uint8 *)symbol_addr + reloc_addend)
(int32)(((intptr_t)((uintptr_t)symbol_addr
+ (intptr_t)reloc_addend)
| 1)
- (intptr_t)(target_section_addr + reloc_offset));
}
Expand Down
12 changes: 7 additions & 5 deletions core/iwasm/aot/arch/aot_reloc_x86_32.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@ check_reloc_offset(uint32 target_section_size, uint64 reloc_offset,
bool
apply_relocation(AOTModule *module, uint8 *target_section_addr,
uint32 target_section_size, uint64 reloc_offset,
uint64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int32 symbol_index, char *error_buf, uint32 error_buf_size)
{
switch (reloc_type) {
Expand All @@ -115,8 +115,9 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,

CHECK_RELOC_OFFSET(sizeof(void *));
value = *(intptr_t *)(target_section_addr + (uint32)reloc_offset);
*(uint8 **)(target_section_addr + reloc_offset) =
(uint8 *)symbol_addr + reloc_addend + value; /* S + A */
*(uintptr_t *)(target_section_addr + reloc_offset) =
(uintptr_t)symbol_addr + (intptr_t)reloc_addend
+ value; /* S + A */
break;
}

Expand All @@ -132,8 +133,9 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,
CHECK_RELOC_OFFSET(sizeof(void *));
value = *(int32 *)(target_section_addr + (uint32)reloc_offset);
*(uint32 *)(target_section_addr + (uint32)reloc_offset) =
(uint32)((uint8 *)symbol_addr + (uint32)reloc_addend
- (uint8 *)(target_section_addr + (uint32)reloc_offset)
(uint32)((uintptr_t)symbol_addr + (intptr_t)reloc_addend
- (uintptr_t)(target_section_addr
+ (uint32)reloc_offset)
+ value); /* S + A - P */
break;
}
Expand Down
14 changes: 7 additions & 7 deletions core/iwasm/aot/arch/aot_reloc_x86_64.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@ check_reloc_offset(uint32 target_section_size, uint64 reloc_offset,
bool
apply_relocation(AOTModule *module, uint8 *target_section_addr,
uint32 target_section_size, uint64 reloc_offset,
uint64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int32 symbol_index, char *error_buf, uint32 error_buf_size)
{
switch (reloc_type) {
Expand All @@ -136,8 +136,8 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,

CHECK_RELOC_OFFSET(sizeof(void *));
value = *(intptr_t *)(target_section_addr + (uint32)reloc_offset);
*(uint8 **)(target_section_addr + reloc_offset) =
(uint8 *)symbol_addr + reloc_addend + value; /* S + A */
*(uintptr_t *)(target_section_addr + reloc_offset) =
(uintptr_t)symbol_addr + reloc_addend + value; /* S + A */
break;
}
#if defined(BH_PLATFORM_WINDOWS)
Expand Down Expand Up @@ -166,8 +166,8 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,
case R_X86_64_PC32:
{
intptr_t target_addr = (intptr_t) /* S + A - P */
((uint8 *)symbol_addr + reloc_addend
- (target_section_addr + reloc_offset));
((uintptr_t)symbol_addr + reloc_addend
- (uintptr_t)(target_section_addr + reloc_offset));

CHECK_RELOC_OFFSET(sizeof(int32));
if ((int32)target_addr != target_addr) {
Expand All @@ -186,8 +186,8 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,
case R_X86_64_32S:
{
char buf[128];
uintptr_t target_addr = (uintptr_t) /* S + A */
((uint8 *)symbol_addr + reloc_addend);
uintptr_t target_addr = /* S + A */
(uintptr_t)symbol_addr + reloc_addend;

CHECK_RELOC_OFFSET(sizeof(int32));

Expand Down
9 changes: 5 additions & 4 deletions core/iwasm/aot/arch/aot_reloc_xtensa.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,7 +145,7 @@ typedef union {
bool
apply_relocation(AOTModule *module, uint8 *target_section_addr,
uint32 target_section_size, uint64 reloc_offset,
uint64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int64 reloc_addend, uint32 reloc_type, void *symbol_addr,
int32 symbol_index, char *error_buf, uint32 error_buf_size)
{
switch (reloc_type) {
Expand All @@ -162,8 +162,8 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,
}
CHECK_RELOC_OFFSET(4);
initial_addend = *(int32 *)insn_addr;
*(uint8 **)insn_addr =
(uint8 *)symbol_addr + initial_addend + reloc_addend;
*(uintptr_t *)insn_addr = (uintptr_t)symbol_addr + initial_addend
+ (intptr_t)reloc_addend;
break;
}

Expand All @@ -185,7 +185,8 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,
initial_addend = (int32)imm16 << 2;
*/

reloc_addr = (uint8 *)symbol_addr + reloc_addend;
reloc_addr =
(uint8 *)((uintptr_t)symbol_addr + (intptr_t)reloc_addend);

if ((intptr_t)reloc_addr & 3) {
set_error_buf(error_buf, error_buf_size,
Expand Down
10 changes: 6 additions & 4 deletions core/iwasm/common/wasm_runtime_common.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2947,10 +2947,12 @@ typedef int32 (*Int32FuncPtr)(GenericFunctionPointer f, uint32 *, uint32);
typedef void (*VoidFuncPtr)(GenericFunctionPointer f, uint32 *, uint32);

static Int64FuncPtr invokeNative_Int64 = (Int64FuncPtr)invokeNative;
static Int32FuncPtr invokeNative_Int32 = (Int32FuncPtr)invokeNative;
static Float64FuncPtr invokeNative_Float64 = (Float64FuncPtr)invokeNative;
static Float32FuncPtr invokeNative_Float32 = (Float32FuncPtr)invokeNative;
static VoidFuncPtr invokeNative_Void = (VoidFuncPtr)invokeNative;
static Int32FuncPtr invokeNative_Int32 = (Int32FuncPtr)(uintptr_t)invokeNative;
static Float64FuncPtr invokeNative_Float64 =
(Float64FuncPtr)(uintptr_t)invokeNative;
static Float32FuncPtr invokeNative_Float32 =
(Float32FuncPtr)(uintptr_t)invokeNative;
static VoidFuncPtr invokeNative_Void = (VoidFuncPtr)(uintptr_t)invokeNative;

static inline void
word_copy(uint32 *dest, uint32 *src, unsigned num)
Expand Down
10 changes: 5 additions & 5 deletions core/iwasm/compilation/aot_emit_aot_file.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2351,16 +2351,16 @@ aot_resolve_object_relocation_group(AOTObjectData *obj_data,
/* parse relocation addend from reloction content */
if (has_addend) {
if (is_binary_32bit) {
uint32 addend =
(uint32)(((struct elf32_rela *)rela_content)->r_addend);
int32 addend =
(int32)(((struct elf32_rela *)rela_content)->r_addend);
if (is_binary_little_endian != is_little_endian())
exchange_uint32((uint8 *)&addend);
relocation->relocation_addend = (uint64)addend;
relocation->relocation_addend = (int64)addend;
rela_content += sizeof(struct elf32_rela);
}
else {
uint64 addend =
(uint64)(((struct elf64_rela *)rela_content)->r_addend);
int64 addend =
(int64)(((struct elf64_rela *)rela_content)->r_addend);
if (is_binary_little_endian != is_little_endian())
exchange_uint64((uint8 *)&addend);
relocation->relocation_addend = addend;
Expand Down
9 changes: 7 additions & 2 deletions core/iwasm/compilation/aot_emit_control.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -422,9 +422,14 @@ aot_compile_op_block(AOTCompContext *comp_ctx, AOTFuncContext *func_ctx,
/* Init aot block data */
block->label_type = label_type;
block->param_count = param_count;
memcpy(block->param_types, param_types, param_count);
if (param_count) {
bh_memcpy_s(block->param_types, param_count, param_types, param_count);
}
block->result_count = result_count;
memcpy(block->result_types, result_types, result_count);
if (result_count) {
bh_memcpy_s(block->result_types, result_count, result_types,
result_count);
}
block->wasm_code_else = else_addr;
block->wasm_code_end = end_addr;
block->block_index = func_ctx->block_stack.block_index[label_type];
Expand Down
Loading