[wasm] Add UTF-8 validation

src/wasm/module-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/wasm/module-decoder.h"
 
 #include "src/base/functional.h"
 #include "src/base/platform/platform.h"
 #include "src/macro-assembler.h"
 #include "src/objects.h"
 #include "src/v8.h"
 
 #include "src/wasm/decoder.h"
+#include "src/wasm/utf8.h"
 
 namespace v8 {
 namespace internal {
 namespace wasm {
 
 #if DEBUG
 #define TRACE(...)                                    \
   do {                                                \
     if (FLAG_trace_wasm_decoder) PrintF(__VA_ARGS__); \
   } while (false)
@@ skipping 236 matching lines @@
           if (functions_count != module->functions.size()) {
             error(pos, pos, "function name count %u mismatch (%u expected)",
                   functions_count,
                   static_cast<uint32_t>(module->functions.size()));
             break;
           }
 
           for (uint32_t i = 0; i < functions_count; i++) {
             WasmFunction* function = &module->functions[i];
             function->name_offset =
-                consume_string(&function->name_length, "function name");
+                consume_string(&function->name_length, false);
 
             uint32_t local_names_count =
                 consume_u32v(&length, "local names count");
             for (uint32_t j = 0; j < local_names_count; j++) {
               uint32_t unused = 0;
-              uint32_t offset = consume_string(&unused, "local name");
+              uint32_t offset = consume_string(&unused, false);
               USE(unused);
               USE(offset);
             }
           }
           break;
         }
         case WasmSection::Code::Globals: {
           int length;
           uint32_t globals_count = consume_u32v(&length, "globals count");
           module->globals.reserve(SafeReserve(globals_count));
@@ skipping 78 matching lines @@
             module->import_table.push_back({nullptr,  // sig
                                             0,        // sig_index
                                             0,        // module_name_offset
                                             0,        // module_name_length
                                             0,        // function_name_offset
                                             0});      // function_name_length
             WasmImport* import = &module->import_table.back();
 
             import->sig_index = consume_sig_index(module, &import->sig);
             const byte* pos = pc_;
-            import->module_name_offset = consume_string(
-                &import->module_name_length, "import module name");
+            import->module_name_offset =
+                consume_string(&import->module_name_length, true);
             if (import->module_name_length == 0) {
               error(pos, "import module name cannot be NULL");
             }
-            import->function_name_offset = consume_string(
-                &import->function_name_length, "import function name");
+            import->function_name_offset =
+                consume_string(&import->function_name_length, true);
           }
           break;
         }
         case WasmSection::Code::ExportTable: {
           // Declares an export table.
           CheckForFunctions(module, section);
           int length;
           uint32_t export_table_count =
               consume_u32v(&length, "export table count");
           module->export_table.reserve(SafeReserve(export_table_count));
           // Decode export table.
           for (uint32_t i = 0; i < export_table_count; i++) {
             if (failed()) break;
             TRACE("DecodeExportTable[%d] module+%d\n", i,
                   static_cast<int>(pc_ - start_));
 
             module->export_table.push_back({0,    // func_index
                                             0,    // name_offset
                                             0});  // name_length
             WasmExport* exp = &module->export_table.back();
 
             WasmFunction* func;
             exp->func_index = consume_func_index(module, &func);
-            exp->name_offset = consume_string(&exp->name_length, "export name");
+            exp->name_offset = consume_string(&exp->name_length, true);
           }
           break;
         }
         case WasmSection::Code::Max:
           // Skip unknown sections.
           TRACE("Unknown section: '");
           for (uint32_t i = 0; i != string_length; ++i) {
             TRACE("%c", *(section_name_start + i));
           }
           TRACE("'\n");
@@ skipping 77 matching lines @@
 
  private:
   Zone* module_zone;
   ModuleResult result_;
   ModuleOrigin origin_;
 
   uint32_t off(const byte* ptr) { return static_cast<uint32_t>(ptr - start_); }
 
   // Decodes a single global entry inside a module starting at {pc_}.
   void DecodeGlobalInModule(WasmGlobal* global) {
-    global->name_offset = consume_string(&global->name_length, "global name");
+    global->name_offset = consume_string(&global->name_length, false);
+    DCHECK(IsValidUtf8(start_ + global->name_offset, global->name_length));
     global->type = mem_type();
     global->offset = 0;
     global->exported = consume_u8("exported") != 0;
   }
 
   // Decodes a single function entry inside a module starting at {pc_}.
   // TODO(titzer): legacy function body; remove
   void DecodeFunctionInModule(WasmModule* module, WasmFunction* function,
                               bool verify_body = true) {
     byte decl_bits = consume_u8("function decl");
 
     const byte* sigpos = pc_;
     function->sig_index = consume_u16("signature index");
 
     if (function->sig_index >= module->signatures.size()) {
       return error(sigpos, "invalid signature index");
     } else {
       function->sig = module->signatures[function->sig_index];
     }
 
     TRACE("  +%d  <function attributes:%s%s%s%s%s>\n",
           static_cast<int>(pc_ - start_),
           decl_bits & kDeclFunctionName ? " name" : "",
           decl_bits & kDeclFunctionImport ? " imported" : "",
           decl_bits & kDeclFunctionLocals ? " locals" : "",
           decl_bits & kDeclFunctionExport ? " exported" : "",
           (decl_bits & kDeclFunctionImport) == 0 ? " body" : "");
 
+    function->exported = decl_bits & kDeclFunctionExport;
+
     if (decl_bits & kDeclFunctionName) {
       function->name_offset =
-          consume_string(&function->name_length, "function name");
+          consume_string(&function->name_length, function->exported);
     }
 
-    function->exported = decl_bits & kDeclFunctionExport;
-
     // Imported functions have no locals or body.
     if (decl_bits & kDeclFunctionImport) {
       function->external = true;
       return;
     }
 
     if (decl_bits & kDeclFunctionLocals) {
       function->local_i32_count = consume_u16("i32 count");
       function->local_i64_count = consume_u16("i64 count");
       function->local_f32_count = consume_u16("f32 count");
@@ skipping 83 matching lines @@
   uint32_t consume_offset(const char* name = nullptr) {
     uint32_t offset = consume_u32(name ? name : "offset");
     if (offset > static_cast<uint32_t>(limit_ - start_)) {
       error(pc_ - sizeof(uint32_t), "offset out of bounds of module");
     }
     return offset;
   }
 
   // Reads a length-prefixed string, checking that it is within bounds. Returns
   // the offset of the string, and the length as an out parameter.
-  uint32_t consume_string(uint32_t* length, const char* name = nullptr) {
+  uint32_t consume_string(uint32_t* length, bool validate_utf8) {
     int varint_length;
     *length = consume_u32v(&varint_length, "string length");
     uint32_t offset = pc_offset();
     TRACE("  +%u  %-20s: (%u bytes)\n", offset, "string", *length);
+    if (validate_utf8 && !IsValidUtf8(pc_, *length)) {
+      error(pc_, "no valid UTF-8 string");
+    }
     consume_bytes(*length);
     return offset;
   }
 
   uint32_t consume_sig_index(WasmModule* module, FunctionSig** sig) {
     const byte* pos = pc_;
     int length;
     uint32_t sig_index = consume_u32v(&length, "signature index");
     if (sig_index >= module->signatures.size()) {
       error(pos, pos, "signature index %u out of bounds (%d signatures)",
@@ skipping 184 matching lines @@
     return FunctionError("size > maximum function size");
   isolate->counters()->wasm_function_size_bytes()->AddSample(
       static_cast<int>(size));
   WasmFunction* function = new WasmFunction();
   ModuleDecoder decoder(zone, function_start, function_end, kWasmOrigin);
   return decoder.DecodeSingleFunction(module_env, function);
 }
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8