[wasm] Data section without memory causes a validation error

src/wasm/module-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/wasm/module-decoder.h"
 
 #include "src/base/functional.h"
 #include "src/base/platform/platform.h"
 #include "src/flags.h"
 #include "src/macro-assembler.h"
@@ skipping 309 matching lines @@
                 &table->max_size);
             break;
           }
           case kExternalMemory: {
             // ===== Imported memory =========================================
             bool has_max = false;
             consume_resizable_limits("memory", "pages", WasmModule::kV8MaxPages,
                                      &module->min_mem_pages, &has_max,
                                      WasmModule::kSpecMaxPages,
                                      &module->max_mem_pages);
+            module->has_memory = true;
             break;
           }
           case kExternalGlobal: {
             // ===== Imported global =========================================
             import->index = static_cast<uint32_t>(module->globals.size());
             module->globals.push_back(
                 {kAstStmt, false, WasmInitExpr(), 0, true, false});
             WasmGlobal* global = &module->globals.back();
             global->type = consume_value_type();
             global->mutability = consume_u8("mutability") != 0;
@@ skipping 64 matching lines @@
       if (memory_count > 1) {
         error(pos, pos, "invalid memory count %d, maximum 1", memory_count);
       }
 
       for (uint32_t i = 0; ok() && i < memory_count; i++) {
         bool has_max = false;
         consume_resizable_limits(
             "memory", "pages", WasmModule::kV8MaxPages, &module->min_mem_pages,
             &has_max, WasmModule::kSpecMaxPages, &module->max_mem_pages);
       }
+      module->has_memory = true;
       section_iter.advance();
     }
 
     // ===== Global section ==================================================
     if (section_iter.section_code() == kGlobalSectionCode) {
       uint32_t globals_count = consume_u32v("globals count");
       uint32_t imported_globals = static_cast<uint32_t>(module->globals.size());
       if (!IsWithinLimit(std::numeric_limits<int32_t>::max(), globals_count,
                          imported_globals)) {
         error(pos, pos, "too many imported+defined globals: %u + %u",
@@ skipping 163 matching lines @@
         consume_bytes(size, "function body");
       }
       section_iter.advance();
     }
 
     // ===== Data section ====================================================
     if (section_iter.section_code() == kDataSectionCode) {
       uint32_t data_segments_count = consume_u32v("data segments count");
       module->data_segments.reserve(SafeReserve(data_segments_count));
       for (uint32_t i = 0; ok() && i < data_segments_count; ++i) {
+        if (!module->has_memory) {
+          error("cannot load data without memory");
+          break;
+        }
         TRACE("DecodeDataSegment[%d] module+%d\n", i,
               static_cast<int>(pc_ - start_));
         module->data_segments.push_back({
             WasmInitExpr(),  // dest_addr
             0,               // source_offset
             0                // source_size
         });
         WasmDataSegment* segment = &module->data_segments.back();
         DecodeDataSegmentInModule(module, segment);
       }
@@ skipping 601 matching lines @@
     table.push_back(std::move(func_asm_offsets));
   }
   if (decoder.more()) decoder.error("unexpected additional bytes");
 
   return decoder.toResult(std::move(table));
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8