Merge pull request #5156 from wasmerio/c-api-doublefree

Resolve double-free error in c-api
wasmerio · Oct 18, 2024 · 8b97cfe · 8b97cfe
2 parents 9b8dcf8 + c978574
commit 8b97cfe
Show file tree

Hide file tree

Showing 4 changed files with 24 additions and 10 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/lib/api/third_party/.gitignore b/lib/api/third_party/.gitignore
@@ -0,0 +1 @@
+wamr
diff --git a/lib/c-api/Cargo.toml b/lib/c-api/Cargo.toml
@@ -111,4 +111,4 @@ jit = ["compiler"]
 #emscripten = ["wasmer-emscripten"]
 
 [build-dependencies]
-cbindgen = { version = "0.24", default-features = false }
+cbindgen = { version = "0.27", default-features = false }
diff --git a/lib/c-api/src/wasm_c_api/value.rs b/lib/c-api/src/wasm_c_api/value.rs
@@ -156,11 +156,24 @@ pub unsafe extern "C" fn wasm_val_copy(
     }); otherwise ());
 }
 
+impl Drop for wasm_val_t {
+    fn drop(&mut self) {
+        let kind: Result<wasm_valkind_enum, _> = self.kind.try_into();
+        match kind {
+            Ok(wasm_valkind_enum::WASM_EXTERNREF) | Ok(wasm_valkind_enum::WASM_FUNCREF) => unsafe {
+                if !self.of.wref.is_null() {
+                    drop(Box::from_raw(self.of.wref));
+                }
+            },
+            _ => {}
+        }
+    }
+}
+
 #[no_mangle]
-pub unsafe extern "C" fn wasm_val_delete(val: Option<Box<wasm_val_t>>) {
-    if let Some(val) = val {
-        // TODO: figure out where wasm_val is allocated first...
-        let _ = val;
+pub unsafe extern "C" fn wasm_val_delete(val: *mut wasm_val_t) {
+    if !val.is_null() {
+        std::ptr::drop_in_place(val);
     }
 }