[wasm] improve handling of malformed input

src/wasm/ast-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/signature.h"
 
 #include "src/bit-vector.h"
 #include "src/flags.h"
 #include "src/handles.h"
 #include "src/zone-containers.h"
@@ skipping 241 matching lines @@
     for (uint32_t i = 0; i < operand.table_count + 1; ++i) {
       uint32_t target = operand.read_entry(this, i);
       if (target >= block_depth) {
         error(operand.table + i * 2, "improper branch in br_table");
         return false;
       }
     }
     return true;
   }
 
-  int OpcodeArity(const byte* pc) {
+  unsigned OpcodeArity(const byte* pc) {
 #define DECLARE_ARITY(name, ...)                          \
   static const LocalType kTypes_##name[] = {__VA_ARGS__}; \
   static const int kArity_##name =                        \
       static_cast<int>(arraysize(kTypes_##name) - 1);
 
     FOREACH_SIGNATURE(DECLARE_ARITY);
 #undef DECLARE_ARITY
 
     switch (static_cast<WasmOpcode>(*pc)) {
       case kExprI8Const:
@@ skipping 60 matching lines @@
         FOREACH_SIMPLE_OPCODE(DECLARE_OPCODE_CASE)
         FOREACH_ASMJS_COMPAT_OPCODE(DECLARE_OPCODE_CASE)
         FOREACH_SIMD_OPCODE(DECLARE_OPCODE_CASE)
 #undef DECLARE_OPCODE_CASE
       default:
         UNREACHABLE();
         return 0;
     }
   }
 
-  int OpcodeLength(const byte* pc) {
+  unsigned OpcodeLength(const byte* pc) {
     switch (static_cast<WasmOpcode>(*pc)) {
 #define DECLARE_OPCODE_CASE(name, opcode, sig) case kExpr##name:
       FOREACH_LOAD_MEM_OPCODE(DECLARE_OPCODE_CASE)
       FOREACH_STORE_MEM_OPCODE(DECLARE_OPCODE_CASE)
 #undef DECLARE_OPCODE_CASE
       {
         MemoryAccessOperand operand(this, pc);
         return 1 + operand.length;
       }
       case kExprBr:
@@ skipping 260 matching lines @@
   // Decodes the body of a function.
   void DecodeFunctionBody() {
     TRACE("wasm-decode %p...%p (module+%d, %d bytes) %s\n",
           reinterpret_cast<const void*>(start_),
           reinterpret_cast<const void*>(limit_), baserel(pc_),
           static_cast<int>(limit_ - start_), builder_ ? "graph building" : "");
 
     if (pc_ >= limit_) return;  // Nothing to do.
 
     while (true) {  // decoding loop.
-      int len = 1;
+      unsigned len = 1;
       WasmOpcode opcode = static_cast<WasmOpcode>(*pc_);
       TRACE("  @%-6d #%02x:%-20s|", startrel(pc_), opcode,
             WasmOpcodes::ShortOpcodeName(opcode));
 
       FunctionSig* sig = WasmOpcodes::Signature(opcode);
       if (sig) {
         // Fast case of a simple operator.
         TFNode* node;
         switch (sig->parameter_count()) {
           case 1: {
@@ skipping 813 matching lines @@
     TRACE(" !%s\n", error_msg_.get());
   }
   BitVector* AnalyzeLoopAssignment(const byte* pc) {
     if (pc >= limit_) return nullptr;
     if (*pc != kExprLoop) return nullptr;
 
     BitVector* assigned =
         new (zone_) BitVector(static_cast<int>(local_type_vec_.size()), zone_);
     int depth = 0;
     // Iteratively process all AST nodes nested inside the loop.
-    while (pc < limit_) {
+    while (pc < limit_ && ok()) {
       WasmOpcode opcode = static_cast<WasmOpcode>(*pc);
-      int length = 1;
+      unsigned length = 1;
       switch (opcode) {
         case kExprLoop:
         case kExprIf:
         case kExprBlock:
           depth++;
           DCHECK_EQ(1, OpcodeLength(pc));
           break;
         case kExprSetLocal: {
           LocalIndexOperand operand(this, pc);
           if (assigned->length() > 0 &&
               static_cast<int>(operand.index) < assigned->length()) {
             // Unverified code might have an out-of-bounds index.
             assigned->Add(operand.index);
           }
           length = 1 + operand.length;
           break;
         }
         case kExprEnd:
           depth--;
           break;
         default:
           length = OpcodeLength(pc);
           break;
       }
       if (depth <= 0) break;
       pc += length;
     }
-    return assigned;
+    return ok() ? assigned : nullptr;
   }
 
   inline wasm::WasmCodePosition position() {
     int offset = static_cast<int>(pc_ - start_);
     DCHECK_EQ(pc_ - start_, offset);  // overflows cannot happen
     return offset;
   }
 };
 
 bool DecodeLocalDecls(AstLocalDecls& decls, const byte* start,
@@ skipping 29 matching lines @@
   PrintF("%s", WasmOpcodes::OpcodeName(tree.opcode()));
   if (tree.count > 0) os << "(";
   for (uint32_t i = 0; i < tree.count; ++i) {
     if (i > 0) os << ", ";
     os << *tree.children[i];
   }
   if (tree.count > 0) os << ")";
   return os;
 }
 
-int OpcodeLength(const byte* pc, const byte* end) {
+unsigned OpcodeLength(const byte* pc, const byte* end) {
   WasmDecoder decoder(nullptr, nullptr, pc, end);
   return decoder.OpcodeLength(pc);
 }
 
-int OpcodeArity(const byte* pc, const byte* end) {
+unsigned OpcodeArity(const byte* pc, const byte* end) {
   WasmDecoder decoder(nullptr, nullptr, pc, end);
   return decoder.OpcodeArity(pc);
 }
 
 void PrintAstForDebugging(const byte* start, const byte* end) {
   base::AccountingAllocator allocator;
   OFStream os(stdout);
   PrintAst(&allocator, FunctionBodyForTesting(start, end), os, nullptr);
 }
 
@@ skipping 27 matching lines @@
       os << (locals == body.start ? "0x" : " 0x") << AsHex(*locals, 2) << ",";
     }
     os << std::endl;
     ++line_nr;
   }
 
   os << "// body: " << std::endl;
   ++line_nr;
   unsigned control_depth = 0;
   while (pc < body.end) {
-    size_t length = decoder.OpcodeLength(pc);
+    unsigned length = decoder.OpcodeLength(pc);
 
     WasmOpcode opcode = static_cast<WasmOpcode>(*pc);
     if (opcode == kExprElse) control_depth--;
 
     int num_whitespaces = control_depth < 32 ? 2 * control_depth : 64;
     if (offset_table) {
       offset_table->push_back(
           std::make_tuple(pc - body.start, line_nr, num_whitespaces));
     }
 
@@ skipping 82 matching lines @@
 BitVector* AnalyzeLoopAssignmentForTesting(Zone* zone, size_t num_locals,
                                            const byte* start, const byte* end) {
   FunctionBody body = {nullptr, nullptr, nullptr, start, end};
   SR_WasmDecoder decoder(zone, nullptr, body);
   return decoder.AnalyzeLoopAssignmentForTesting(start, num_locals);
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8