Open
Description
In the read_function_body()
function, the code reading the local variable declarations looks like this:
for _ in 0..local_count {
let (count, ty) = self.reader.read_local_decl()?;
locals_total += count as usize;
if locals_total > MAX_WASM_FUNCTION_LOCALS {
return Err(BinaryReaderError {
message: "local_count is out of bounds",
offset: self.reader.position - 1,
});
}
locals.push((count, ty));
}
In a 32-bit build, the addition in locals_total += count as usize
could overflow which causes a panic only in debug builds. In release builds it silently wraps.
A fuzz tester running on a 32-bit build would probably catch that.