[wasm] Fix and tighten memory validation

src/wasm/wasm-module.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <memory>
 
 #include "src/assembler-inl.h"
 #include "src/base/adapters.h"
 #include "src/base/atomic-utils.h"
 #include "src/code-stubs.h"
@@ skipping 1287 matching lines @@
     } else if (min_mem_pages > 0) {
       memory_ = AllocateMemory(min_mem_pages);
       if (memory_.is_null()) return nothing;  // failed to allocate memory
     }
 
     if (!memory_.is_null()) {
       instance->set_memory_buffer(*memory_);
       Address mem_start = static_cast<Address>(memory_->backing_store());
       uint32_t mem_size =
           static_cast<uint32_t>(memory_->byte_length()->Number());
-      LoadDataSegments(mem_start, mem_size);
+      if (!LoadDataSegments(mem_start, mem_size)) return nothing;
 
       uint32_t old_mem_size = compiled_module_->mem_size();
       Address old_mem_start =
           compiled_module_->has_memory()
               ? static_cast<Address>(
                     compiled_module_->memory()->backing_store())
               : nullptr;
       RelocateMemoryReferencesInCode(code_table, old_mem_start, mem_start,
                                      old_mem_size, mem_size);
       compiled_module_->set_memory(memory_);
     } else {
-      LoadDataSegments(nullptr, 0);
+      if (!LoadDataSegments(nullptr, 0)) return nothing;
     }
 
     //--------------------------------------------------------------------------
     // Set up the runtime support for the new instance.
     //--------------------------------------------------------------------------
     Handle<WeakCell> weak_link = factory->NewWeakCell(instance);
 
     for (int i = num_imported_functions + FLAG_skip_compiling_wasm_funcs;
          i < code_table->length(); ++i) {
       Handle<Code> code = code_table->GetValueChecked<Code>(isolate_, i);
@@ skipping 212 matching lines @@
         uint32_t offset = module_->globals[expr.val.global_index].offset;
         return *reinterpret_cast<uint32_t*>(raw_buffer_ptr(globals_, offset));
       }
       default:
         UNREACHABLE();
         return 0;
     }
   }
 
   // Load data segments into the memory.
-  void LoadDataSegments(Address mem_addr, size_t mem_size) {
+  bool LoadDataSegments(Address mem_addr, size_t mem_size) {
     Handle<SeqOneByteString> module_bytes(compiled_module_->module_bytes(),
                                           isolate_);
     for (const WasmDataSegment& segment : module_->data_segments) {
       uint32_t source_size = segment.source_size;
       // Segments of size == 0 are just nops.
       if (source_size == 0) continue;
       uint32_t dest_offset = EvalUint32InitExpr(segment.dest_addr);
-      if (dest_offset >= mem_size || source_size >= mem_size ||
-          dest_offset > (mem_size - source_size)) {
+      if (dest_offset + source_size > mem_size ||
+          dest_offset + source_size < dest_offset) {
         thrower_->LinkError("data segment (start = %" PRIu32 ", size = %" PRIu32
                             ") does not fit into memory (size = %" PRIuS ")",
                             dest_offset, source_size, mem_size);
-        return;
+        return false;
       }
       byte* dest = mem_addr + dest_offset;
       const byte* src = reinterpret_cast<const byte*>(
           module_bytes->GetCharsAddress() + segment.source_offset);
       memcpy(dest, src, source_size);
     }
+    return true;
   }
 
   void WriteGlobalValue(WasmGlobal& global, Handle<Object> value) {
     double num = 0;
     if (value->IsSmi()) {
       num = Smi::cast(*value)->value();
     } else if (value->IsHeapNumber()) {
       num = HeapNumber::cast(*value)->value();
     } else {
       UNREACHABLE();
@@ skipping 981 matching lines @@
 
     JSObject::AddProperty(entry, name_string, export_name.ToHandleChecked(),
                           NONE);
     JSObject::AddProperty(entry, kind_string, export_kind, NONE);
 
     storage->set(index, *entry);
   }
 
   return array_object;
 }