Commit 5e7428b5 authored by ahaas's avatar ahaas Committed by Commit bot

[wasm] Read global names only if their name length is valid.

BUG=chromium:642987
R=titzer@chromium.org
TEST=module-decoder-unittest.cc:GlobalWithInvalidNameLength

Review-Url: https://codereview.chromium.org/2301873002
Cr-Commit-Position: refs/heads/master@{#39071}
parent fd5fe3b2
......@@ -461,7 +461,8 @@ class ModuleDecoder : public Decoder {
// Decodes a single global entry inside a module starting at {pc_}.
void DecodeGlobalInModule(WasmGlobal* global) {
global->name_offset = consume_string(&global->name_length, false);
if (!unibrow::Utf8::Validate(start_ + global->name_offset,
if (ok() &&
!unibrow::Utf8::Validate(start_ + global->name_offset,
global->name_length)) {
error("global name is not valid utf8");
}
......
......@@ -279,6 +279,18 @@ TEST_F(WasmModuleVerifyTest, GlobalWithInvalidNameOffset) {
EXPECT_FAILURE(data);
}
TEST_F(WasmModuleVerifyTest, GlobalWithInvalidNameLength) {
static const byte data[] = {
SECTION(GLOBALS, 5), // --
1,
NAME_LENGTH(56), // invalid length
'g', // name
kLocalI32, // memory type
0, // exported
};
EXPECT_FAILURE(data);
}
TEST_F(WasmModuleVerifyTest, GlobalWithInvalidMemoryType) {
static const byte data[] = {
SECTION(GLOBALS, 7),
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment