Skip to content

wasm2c: (Security) ensure tailcalls use initialized instance references for all cases - #2857

Open
shravanrn wants to merge 1 commit into
WebAssembly:mainfrom
UT-Security:fix-tailcalls
Open

shravanrn wants to merge 1 commit into
WebAssembly:mainfrom
UT-Security:fix-tailcalls

Conversation

@shravanrn

Copy link
Copy Markdown
Collaborator

This PR fixes a case in the tail-call implementation in wasm2c where the instance_ptr is not initialized before being passed to a callee --- on a ReturnCall to a non-imported function. As an added defense in depth instance_ptr is explicitly initialized to zero to ensure such bugs would result in an unexploitable crash in the future.

@shravanrn
shravanrn requested review from keithw and sbc100 September 15, 2026 06:48
@shravanrn shravanrn changed the title wasm2c: (Security) ensure tailcalls use initialized instance references wasm2c: (Security) ensure tailcalls use initialized instance references for all cases Sep 15, 2026
static_assert(sizeof(struct wasm_multi_id) <= 1024);
{
void *instance_ptr_storage;
void *instance_ptr_storage = 0;

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why setting it 0 instead of instance? Then the line below is unnecessary.
And why 0 instead of NULL or nullptr? I know 0 is accepted, but looks strange.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants