Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(74)

Side by Side Diff: src/wasm/wasm-module.cc

Issue 2486183002: [wasm] Fix bounds check in LoadDataSegments. (Closed)
Patch Set: Created 4 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | test/cctest/wasm/test-run-wasm-module.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2015 the V8 project authors. All rights reserved. 1 // Copyright 2015 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include <memory> 5 #include <memory>
6 6
7 #include "src/base/atomic-utils.h" 7 #include "src/base/atomic-utils.h"
8 #include "src/code-stubs.h" 8 #include "src/code-stubs.h"
9 9
10 #include "src/macro-assembler.h" 10 #include "src/macro-assembler.h"
(...skipping 1348 matching lines...) Expand 10 before | Expand all | Expand 10 after
1359 } 1359 }
1360 } 1360 }
1361 1361
1362 // Load data segments into the memory. 1362 // Load data segments into the memory.
1363 void LoadDataSegments(Address mem_addr, size_t mem_size) { 1363 void LoadDataSegments(Address mem_addr, size_t mem_size) {
1364 Handle<SeqOneByteString> module_bytes = compiled_module_->module_bytes(); 1364 Handle<SeqOneByteString> module_bytes = compiled_module_->module_bytes();
1365 for (auto segment : module_->data_segments) { 1365 for (auto segment : module_->data_segments) {
1366 uint32_t dest_offset = EvalUint32InitExpr(segment.dest_addr); 1366 uint32_t dest_offset = EvalUint32InitExpr(segment.dest_addr);
1367 uint32_t source_size = segment.source_size; 1367 uint32_t source_size = segment.source_size;
1368 if (dest_offset >= mem_size || source_size >= mem_size || 1368 if (dest_offset >= mem_size || source_size >= mem_size ||
1369 dest_offset >= (mem_size - source_size)) { 1369 dest_offset > (mem_size - source_size)) {
1370 thrower_->RangeError("data segment does not fit into memory"); 1370 thrower_->RangeError(
1371 "data segment (start = %u, size = %u) does not fit into memory "
1372 "(size = %zu)",
1373 dest_offset, source_size, mem_size);
1374 return;
1371 } 1375 }
1372 byte* dest = mem_addr + dest_offset; 1376 byte* dest = mem_addr + dest_offset;
1373 const byte* src = reinterpret_cast<const byte*>( 1377 const byte* src = reinterpret_cast<const byte*>(
1374 module_bytes->GetCharsAddress() + segment.source_offset); 1378 module_bytes->GetCharsAddress() + segment.source_offset);
1375 memcpy(dest, src, source_size); 1379 memcpy(dest, src, source_size);
1376 } 1380 }
1377 } 1381 }
1378 1382
1379 void WriteGlobalValue(WasmGlobal& global, Handle<Object> value) { 1383 void WriteGlobalValue(WasmGlobal& global, Handle<Object> value) {
1380 double num = 0; 1384 double num = 0;
(...skipping 865 matching lines...) Expand 10 before | Expand all | Expand 10 after
2246 CHECK_NOT_NULL(result.val); 2250 CHECK_NOT_NULL(result.val);
2247 module = const_cast<WasmModule*>(result.val); 2251 module = const_cast<WasmModule*>(result.val);
2248 } 2252 }
2249 2253
2250 Handle<WasmModuleWrapper> module_wrapper = 2254 Handle<WasmModuleWrapper> module_wrapper =
2251 WasmModuleWrapper::New(isolate, module); 2255 WasmModuleWrapper::New(isolate, module);
2252 2256
2253 compiled_module->set_module_wrapper(module_wrapper); 2257 compiled_module->set_module_wrapper(module_wrapper);
2254 DCHECK(WasmCompiledModule::IsWasmCompiledModule(*compiled_module)); 2258 DCHECK(WasmCompiledModule::IsWasmCompiledModule(*compiled_module));
2255 } 2259 }
OLDNEW
« no previous file with comments | « no previous file | test/cctest/wasm/test-run-wasm-module.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698