[crash/fuzzing] Resources exhaustion (CPU/MEM) using wasmprinter::print_bytes()

[pventuzelo]

During fuzzing of wasmprinter, I trigger a resources exhaustion bug leading to full CPU usage when parsing a crafted wasm module. The file is only 650 bytes in size.

Download: huge_cpu_usage_wasmprinter.zip

Repo:

use std::env;
use std::fs::File;
use std::io;
use std::io::Read;

/// Read the contents from file path
fn read_contents_from_path(path_str: &String) -> Result<Vec<u8>, io::Error> {
    let mut buffer: Vec<u8> = Vec::new();
    let file_path = std::path::PathBuf::from(path_str);

    println!("file_to_process: {:?}", file_path);

    let mut file = File::open(file_path)?;
    file.read_to_end(&mut buffer)?;
    drop(file);
    Ok(buffer)
}

fn main() {
    println!("Start debugging of wasmprinter_parser");
    let args: Vec<String> = env::args().collect();

    // verify file_to_process is provided
    if args.len() != 2 {
        println!("Usage: wasmprinter_parser <file_to_process>\n");
        return;
    }

    // read data from provided file
    let data = read_contents_from_path(&args[1]).expect("cannot read file content");

    // call the fuzzing target
    wasmprinter::print_bytes(&data).is_ok();

    println!("No crash, everything is OK\n");
}

[pventuzelo]

Here is another one that trigger an error this time:

memory allocation of 4294967296 bytes failed[1]    12638 abort (core dumped)

Download: mem_alloc_failed_wasmprinter.zip

[alexcrichton]

Thanks for the report! Turns out those are both the same issue, fixed by #53.