[wasm] improve handling of malformed input

src/wasm/ast-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/signature.h"
 
 #include "src/bit-vector.h"
 #include "src/flags.h"
 #include "src/handles.h"
 #include "src/zone-containers.h"
@@ skipping 220 matching lines @@
     for (uint32_t i = 0; i < operand.table_count + 1; i++) {
       uint32_t target = operand.read_entry(this, i);
       if (target >= block_depth) {
         error(operand.table + i * 2, "improper branch in br_table");
         return false;
       }
     }
     return true;
   }
 
-  int OpcodeArity(const byte* pc) {
+  unsigned int OpcodeArity(const byte* pc) {
 #define DECLARE_ARITY(name, ...)                          \
   static const LocalType kTypes_##name[] = {__VA_ARGS__}; \
   static const int kArity_##name =                        \
       static_cast<int>(arraysize(kTypes_##name) - 1);
 
     FOREACH_SIGNATURE(DECLARE_ARITY);
 #undef DECLARE_ARITY
 
     switch (static_cast<WasmOpcode>(*pc)) {
       case kExprI8Const:
@@ skipping 60 matching lines @@
         FOREACH_SIMPLE_OPCODE(DECLARE_OPCODE_CASE)
         FOREACH_ASMJS_COMPAT_OPCODE(DECLARE_OPCODE_CASE)
         FOREACH_SIMD_OPCODE(DECLARE_OPCODE_CASE)
 #undef DECLARE_OPCODE_CASE
       default:
         UNREACHABLE();
         return 0;
     }
   }
 
-  int OpcodeLength(const byte* pc) {
+  unsigned int OpcodeLength(const byte* pc) {
     switch (static_cast<WasmOpcode>(*pc)) {
 #define DECLARE_OPCODE_CASE(name, opcode, sig) case kExpr##name:
       FOREACH_LOAD_MEM_OPCODE(DECLARE_OPCODE_CASE)
       FOREACH_STORE_MEM_OPCODE(DECLARE_OPCODE_CASE)
 #undef DECLARE_OPCODE_CASE
       {
         MemoryAccessOperand operand(this, pc);
         return 1 + operand.length;
       }
       case kExprBr:
@@ skipping 223 matching lines @@
   void DecodeLocalDecls() {
     DCHECK_EQ(0, local_type_vec_.size());
     // Initialize {local_type_vec} from signature.
     if (sig_) {
       local_type_vec_.reserve(sig_->parameter_count());
       for (size_t i = 0; i < sig_->parameter_count(); i++) {
         local_type_vec_.push_back(sig_->GetParam(i));
       }
     }
     // Decode local declarations, if any.
-    int length;
+    unsigned int length;
     uint32_t entries = consume_u32v(&length, "local decls count");
     while (entries-- > 0 && pc_ < limit_) {
       uint32_t count = consume_u32v(&length, "local count");
       byte code = consume_u8("local type");
       LocalType type;
       switch (code) {
         case kLocalI32:
           type = kAstI32;
           break;
         case kLocalI64:
@@ skipping 17 matching lines @@
   // Decodes the body of a function.
   void DecodeFunctionBody() {
     TRACE("wasm-decode %p...%p (module+%d, %d bytes) %s\n",
           reinterpret_cast<const void*>(start_),
           reinterpret_cast<const void*>(limit_), baserel(pc_),
           static_cast<int>(limit_ - start_), builder_ ? "graph building" : "");
 
     if (pc_ >= limit_) return;  // Nothing to do.
 
     while (true) {  // decoding loop.
-      int len = 1;
+      unsigned int len = 1;
       WasmOpcode opcode = static_cast<WasmOpcode>(*pc_);
       TRACE("  @%-6d #%02x:%-20s|", startrel(pc_), opcode,
             WasmOpcodes::ShortOpcodeName(opcode));
 
       FunctionSig* sig = WasmOpcodes::Signature(opcode);
       if (sig) {
         // Fast case of a simple operator.
         TFNode* node;
         switch (sig->parameter_count()) {
           case 1: {
@@ skipping 815 matching lines @@
   BitVector* AnalyzeLoopAssignment(const byte* pc) {
     if (pc >= limit_) return nullptr;
     if (*pc != kExprLoop) return nullptr;
 
     BitVector* assigned =
         new (zone_) BitVector(static_cast<int>(local_type_vec_.size()), zone_);
     int depth = 0;
     // Iteratively process all AST nodes nested inside the loop.
     while (pc < limit_) {
       WasmOpcode opcode = static_cast<WasmOpcode>(*pc);
-      int length = 1;
+      unsigned int length = 1;
       switch (opcode) {
         case kExprLoop:
         case kExprIf:
         case kExprBlock:
           depth++;
           DCHECK_EQ(1, OpcodeLength(pc));
           break;
         case kExprSetLocal: {
           LocalIndexOperand operand(this, pc);
           if (assigned->length() > 0 &&
@@ skipping 57 matching lines @@
   PrintF("%s", WasmOpcodes::OpcodeName(tree.opcode()));
   if (tree.count > 0) os << "(";
   for (uint32_t i = 0; i < tree.count; i++) {
     if (i > 0) os << ", ";
     os << *tree.children[i];
   }
   if (tree.count > 0) os << ")";
   return os;
 }
 
-int OpcodeLength(const byte* pc, const byte* end) {
+unsigned int OpcodeLength(const byte* pc, const byte* end) {
   WasmDecoder decoder(nullptr, nullptr, pc, end);
   return decoder.OpcodeLength(pc);
 }
 
-int OpcodeArity(const byte* pc, const byte* end) {
+unsigned int OpcodeArity(const byte* pc, const byte* end) {
   WasmDecoder decoder(nullptr, nullptr, pc, end);
   return decoder.OpcodeArity(pc);
 }
 
 void PrintAstForDebugging(const byte* start, const byte* end) {
   FunctionBody body = {nullptr, nullptr, start, start, end};
   base::AccountingAllocator allocator;
   PrintAst(&allocator, body);
 }
 
@@ skipping 23 matching lines @@
 
     for (const byte* locals = body.start; locals < pc; locals++) {
       printf(" 0x%02x,", *locals);
     }
     os << std::endl;
   }
 
   os << "// body: \n";
   int control_depth = 0;
   while (pc < body.end) {
-    size_t length = decoder.OpcodeLength(pc);
+    unsigned int length = decoder.OpcodeLength(pc);
 
     WasmOpcode opcode = static_cast<WasmOpcode>(*pc);
     if (opcode == kExprElse) control_depth--;
 
     for (int i = 0; i < control_depth && i < 32; i++) printf("  ");
     printf("k%s,", WasmOpcodes::OpcodeName(opcode));
 
     for (size_t i = 1; i < length; i++) {
       printf(" 0x%02x,", pc[i]);
     }
@@ skipping 70 matching lines @@
 BitVector* AnalyzeLoopAssignmentForTesting(Zone* zone, size_t num_locals,
                                            const byte* start, const byte* end) {
   FunctionBody body = {nullptr, nullptr, nullptr, start, end};
   SR_WasmDecoder decoder(zone, nullptr, body);
   return decoder.AnalyzeLoopAssignmentForTesting(start, num_locals);
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8