Null pointer Deference in WasmBinaryBuilder::getFunctionIndexName(unsigned int) in wasm/wasm-binary.cpp #1879
Description
Hi, there.
A Null pointer Deference problem was discovered in WasmBinaryBuilder::getFunctionIndexName(unsigned int) in wasm/wasm-binary.cpp. A crafted wasm input can cause segment faults and I have confirmed them with address sanitizer too.
Here are the POC files. Please use "wasm-opt $POC" to reproduce the problem.
POC.zip
git log
commit 0e5e55053c171b138a0cf5aa8a08de8c7714048f
Author: Alon Zakai <[email protected]>
Date: Sat Jan 19 05:30:43 2019 -0800
Show a proper error on an invalid type in binary reading ; fixes #1872 (#1874)
The ASAN dumps the stack trace as follows:
AddressSanitizer:DEADLYSIGNAL
=================================================================
==14886==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000009ace8e bp 0x7ffccfd53b70 sp 0x7ffccfd539a0 T0)
==14886==The signal is caused by a READ memory access.
==14886==Hint: address points to the zero page.
#0 0x9ace8d in wasm::WasmBinaryBuilder::getFunctionIndexName(unsigned int) /home/wencheng/Documents/FuzzingObject/binaryen/src/wasm/wasm-binary.cpp:970:10
#1 0x9ace8d in wasm::WasmBinaryBuilder::processFunctions() /home/wencheng/Documents/FuzzingObject/binaryen/src/wasm/wasm-binary.cpp:1508
#2 0x980f41 in wasm::WasmBinaryBuilder::read() /home/wencheng/Documents/FuzzingObject/binaryen/src/wasm/wasm-binary.cpp:706:3
#3 0xa81ed9 in wasm::ModuleReader::readBinary(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, wasm::Module&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >) /home/wencheng/Documents/FuzzingObject/binaryen/src/wasm/wasm-io.cpp:52:10
#4 0xa84b1c in wasm::ModuleReader::read(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, wasm::Module&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >) /home/wencheng/Documents/FuzzingObject/binaryen/src/wasm/wasm-io.cpp:71:5
#5 0x627919 in main /home/wencheng/Documents/FuzzingObject/binaryen/src/tools/wasm-opt.cpp:144:14
#6 0x7fac33df582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#7 0x51c5b8 in _start (/home/wencheng/Documents/FuzzingObject/binaryen/build/bin/wasm-opt+0x51c5b8)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/wencheng/Documents/FuzzingObject/binaryen/src/wasm/wasm-binary.cpp:970:10 in wasm::WasmBinaryBuilder::getFunctionIndexName(unsigned int)
==14886==ABORTING