[wasm] improve handling of malformed input

src/wasm/module-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/wasm/module-decoder.h"
 
 #include "src/base/functional.h"
 #include "src/base/platform/platform.h"
 #include "src/macro-assembler.h"
 #include "src/objects.h"
@@ skipping 90 matching lines @@
         goto done;
       }
     }
 
     // Decode the module sections.
     while (pc_ < limit_) {
       TRACE("DecodeSection\n");
       pos = pc_;
 
       // Read the section name.
-      int string_leb_length = 0;
+      unsigned string_leb_length = 0;
       uint32_t string_length =
           consume_u32v(&string_leb_length, "section name length");
       const byte* section_name_start = pc_;
       consume_bytes(string_length);
       if (failed()) {
         TRACE("Section name of length %u couldn't be read\n", string_length);
         break;
       }
 
       TRACE("  +%d  section name        : \"%.*s\"\n",
             static_cast<int>(section_name_start - start_),
             string_length < 20 ? string_length : 20, section_name_start);
 
       WasmSection::Code section =
           WasmSection::lookup(section_name_start, string_length);
 
       // Read and check the section size.
-      int section_leb_length = 0;
+      unsigned section_leb_length = 0;
       uint32_t section_length =
           consume_u32v(&section_leb_length, "section length");
       if (!checkAvailable(section_length)) {
         // The section would extend beyond the end of the module.
         break;
       }
       const byte* section_start = pc_;
       const byte* expected_section_end = pc_ + section_length;
 
       current_order = CheckSectionOrder(current_order, section);
 
       switch (section) {
         case WasmSection::Code::End:
           // Terminate section decoding.
           limit_ = pc_;
           break;
         case WasmSection::Code::Memory: {
-          int length;
+          unsigned length;
           module->min_mem_pages = consume_u32v(&length, "min memory");
           module->max_mem_pages = consume_u32v(&length, "max memory");
           module->mem_export = consume_u8("export memory") != 0;
           break;
         }
         case WasmSection::Code::Signatures: {
-          int length;
+          unsigned length;
           uint32_t signatures_count = consume_u32v(&length, "signatures count");
           module->signatures.reserve(SafeReserve(signatures_count));
           // Decode signatures.
           for (uint32_t i = 0; i < signatures_count; i++) {
             if (failed()) break;
             TRACE("DecodeSignature[%d] module+%d\n", i,
                   static_cast<int>(pc_ - start_));
             FunctionSig* s = consume_sig();
             module->signatures.push_back(s);
           }
           break;
         }
         case WasmSection::Code::FunctionSignatures: {
-          int length;
+          unsigned length;
           uint32_t functions_count = consume_u32v(&length, "functions count");
           module->functions.reserve(SafeReserve(functions_count));
           for (uint32_t i = 0; i < functions_count; i++) {
             module->functions.push_back({nullptr,  // sig
                                          i,        // func_index
                                          0,        // sig_index
                                          0,        // name_offset
                                          0,        // name_length
                                          0,        // code_start_offset
                                          0});      // code_end_offset
             WasmFunction* function = &module->functions.back();
             function->sig_index = consume_sig_index(module, &function->sig);
           }
           break;
         }
         case WasmSection::Code::FunctionBodies: {
-          int length;
+          unsigned length;
           const byte* pos = pc_;
           uint32_t functions_count = consume_u32v(&length, "functions count");
           if (functions_count != module->functions.size()) {
             error(pos, pos, "function body count %u mismatch (%u expected)",
                   functions_count,
                   static_cast<uint32_t>(module->functions.size()));
             break;
           }
           for (uint32_t i = 0; i < functions_count; i++) {
             WasmFunction* function = &module->functions[i];
-            int length;
+            unsigned length;
             uint32_t size = consume_u32v(&length, "body size");
             function->code_start_offset = pc_offset();
             function->code_end_offset = pc_offset() + size;
 
             TRACE("  +%d  %-20s: (%d bytes)\n", pc_offset(), "function body",
                   size);
             pc_ += size;
             if (pc_ > limit_) {
               error(pc_, "function body extends beyond end of file");
             }
           }
           break;
         }
         case WasmSection::Code::Names: {
-          int length;
+          unsigned length;
           const byte* pos = pc_;
           uint32_t functions_count = consume_u32v(&length, "functions count");
           if (functions_count != module->functions.size()) {
             error(pos, pos, "function name count %u mismatch (%u expected)",
                   functions_count,
                   static_cast<uint32_t>(module->functions.size()));
             break;
           }
 
           for (uint32_t i = 0; i < functions_count; i++) {
             WasmFunction* function = &module->functions[i];
             function->name_offset =
                 consume_string(&function->name_length, false);
 
             uint32_t local_names_count =
                 consume_u32v(&length, "local names count");
             for (uint32_t j = 0; j < local_names_count; j++) {
               uint32_t unused = 0;
               uint32_t offset = consume_string(&unused, false);
               USE(unused);
               USE(offset);
             }
           }
           break;
         }
         case WasmSection::Code::Globals: {
-          int length;
+          unsigned length;
           uint32_t globals_count = consume_u32v(&length, "globals count");
           module->globals.reserve(SafeReserve(globals_count));
           // Decode globals.
           for (uint32_t i = 0; i < globals_count; i++) {
             if (failed()) break;
             TRACE("DecodeGlobal[%d] module+%d\n", i,
                   static_cast<int>(pc_ - start_));
             module->globals.push_back({0, 0, MachineType::Int32(), 0, false});
             WasmGlobal* global = &module->globals.back();
             DecodeGlobalInModule(global);
           }
           break;
         }
         case WasmSection::Code::DataSegments: {
-          int length;
+          unsigned length;
           uint32_t data_segments_count =
               consume_u32v(&length, "data segments count");
           module->data_segments.reserve(SafeReserve(data_segments_count));
           // Decode data segments.
           for (uint32_t i = 0; i < data_segments_count; i++) {
             if (failed()) break;
             TRACE("DecodeDataSegment[%d] module+%d\n", i,
                   static_cast<int>(pc_ - start_));
             module->data_segments.push_back({0,        // dest_addr
                                              0,        // source_offset
                                              0,        // source_size
                                              false});  // init
             WasmDataSegment* segment = &module->data_segments.back();
             DecodeDataSegmentInModule(module, segment);
           }
           break;
         }
         case WasmSection::Code::FunctionTable: {
           // An indirect function table requires functions first.
           CheckForFunctions(module, section);
-          int length;
+          unsigned length;
           uint32_t function_table_count =
               consume_u32v(&length, "function table count");
           module->function_table.reserve(SafeReserve(function_table_count));
           // Decode function table.
           for (uint32_t i = 0; i < function_table_count; i++) {
             if (failed()) break;
             TRACE("DecodeFunctionTable[%d] module+%d\n", i,
                   static_cast<int>(pc_ - start_));
             uint16_t index = consume_u32v(&length);
             if (index >= module->functions.size()) {
@@ skipping 14 matching lines @@
           WasmFunction* func;
           const byte* pos = pc_;
           module->start_function_index = consume_func_index(module, &func);
           if (func && func->sig->parameter_count() > 0) {
             error(pos, "invalid start function: non-zero parameter count");
             break;
           }
           break;
         }
         case WasmSection::Code::ImportTable: {
-          int length;
+          unsigned length;
           uint32_t import_table_count =
               consume_u32v(&length, "import table count");
           module->import_table.reserve(SafeReserve(import_table_count));
           // Decode import table.
           for (uint32_t i = 0; i < import_table_count; i++) {
             if (failed()) break;
             TRACE("DecodeImportTable[%d] module+%d\n", i,
                   static_cast<int>(pc_ - start_));
 
             module->import_table.push_back({nullptr,  // sig
@@ skipping 12 matching lines @@
               error(pos, "import module name cannot be NULL");
             }
             import->function_name_offset =
                 consume_string(&import->function_name_length, true);
           }
           break;
         }
         case WasmSection::Code::ExportTable: {
           // Declares an export table.
           CheckForFunctions(module, section);
-          int length;
+          unsigned length;
           uint32_t export_table_count =
               consume_u32v(&length, "export table count");
           module->export_table.reserve(SafeReserve(export_table_count));
           // Decode export table.
           for (uint32_t i = 0; i < export_table_count; i++) {
             if (failed()) break;
             TRACE("DecodeExportTable[%d] module+%d\n", i,
                   static_cast<int>(pc_ - start_));
 
             module->export_table.push_back({0,    // func_index
@@ skipping 111 matching lines @@
 
   bool IsWithinLimit(uint32_t limit, uint32_t offset, uint32_t size) {
     if (offset > limit) return false;
     if ((offset + size) < offset) return false;  // overflow
     return (offset + size) <= limit;
   }
 
   // Decodes a single data segment entry inside a module starting at {pc_}.
   void DecodeDataSegmentInModule(WasmModule* module, WasmDataSegment* segment) {
     const byte* start = pc_;
-    int length;
+    unsigned length;
     segment->dest_addr = consume_u32v(&length, "destination");
     segment->source_size = consume_u32v(&length, "source size");
     segment->source_offset = static_cast<uint32_t>(pc_ - start_);
     segment->init = true;
 
     // Validate the data is in the module.
     uint32_t module_limit = static_cast<uint32_t>(limit_ - start_);
     if (!IsWithinLimit(module_limit, segment->source_offset,
                        segment->source_size)) {
       error(start, "segment out of bounds of module");
@@ skipping 63 matching lines @@
     uint32_t offset = consume_u32(name ? name : "offset");
     if (offset > static_cast<uint32_t>(limit_ - start_)) {
       error(pc_ - sizeof(uint32_t), "offset out of bounds of module");
     }
     return offset;
   }
 
   // Reads a length-prefixed string, checking that it is within bounds. Returns
   // the offset of the string, and the length as an out parameter.
   uint32_t consume_string(uint32_t* length, bool validate_utf8) {
-    int varint_length;
+    unsigned varint_length;
     *length = consume_u32v(&varint_length, "string length");
     uint32_t offset = pc_offset();
     TRACE("  +%u  %-20s: (%u bytes)\n", offset, "string", *length);
     if (validate_utf8 && !unibrow::Utf8::Validate(pc_, *length)) {
       error(pc_, "no valid UTF-8 string");
     }
     consume_bytes(*length);
     return offset;
   }
 
   uint32_t consume_sig_index(WasmModule* module, FunctionSig** sig) {
     const byte* pos = pc_;
-    int length;
+    unsigned length;
     uint32_t sig_index = consume_u32v(&length, "signature index");
     if (sig_index >= module->signatures.size()) {
       error(pos, pos, "signature index %u out of bounds (%d signatures)",
             sig_index, static_cast<int>(module->signatures.size()));
       *sig = nullptr;
       return 0;
     }
     *sig = module->signatures[sig_index];
     return sig_index;
   }
 
   uint32_t consume_func_index(WasmModule* module, WasmFunction** func) {
     const byte* pos = pc_;
-    int length;
+    unsigned length;
     uint32_t func_index = consume_u32v(&length, "function index");
     if (func_index >= module->functions.size()) {
       error(pos, pos, "function index %u out of bounds (%d functions)",
             func_index, static_cast<int>(module->functions.size()));
       *func = nullptr;
       return 0;
     }
     *func = &module->functions[func_index];
     return func_index;
   }
@@ skipping 54 matching lines @@
 
   // Parses a type entry, which is currently limited to functions only.
   FunctionSig* consume_sig() {
     const byte* pos = pc_;
     byte form = consume_u8("type form");
     if (form != kWasmFunctionTypeForm) {
       error(pos, pos, "expected function type form (0x%02x), got: 0x%02x",
             kWasmFunctionTypeForm, form);
       return nullptr;
     }
-    int length;
+    unsigned length;
     // parse parameter types
     uint32_t param_count = consume_u32v(&length, "param count");
     std::vector<LocalType> params;
     for (uint32_t i = 0; i < param_count; i++) {
       LocalType param = consume_local_type();
       if (param == kAstStmt) error(pc_ - 1, "invalid void parameter type");
       params.push_back(param);
     }
 
     // parse return types
@@ skipping 87 matching lines @@
     return FunctionError("size > maximum function size");
   isolate->counters()->wasm_function_size_bytes()->AddSample(
       static_cast<int>(size));
   WasmFunction* function = new WasmFunction();
   ModuleDecoder decoder(zone, function_start, function_end, kWasmOrigin);
   return decoder.DecodeSingleFunction(module_env, function);
 }
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8