Skip to content

Commit 6572796

Browse files
authored
Add missing in_function_body check to objdump (#2591)
Fixes the fuzzer bug in #2567 I noticed all objdump logs are guarded by `if (!in_function_body)`. The code crashes without this check.
1 parent 879af11 commit 6572796

File tree

2 files changed

+25
-1
lines changed

2 files changed

+25
-1
lines changed

src/binary-reader-objdump.cc

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -797,8 +797,9 @@ Result BinaryReaderObjdumpDisassemble::OnOpcodeUint32(uint32_t value) {
797797

798798
Result BinaryReaderObjdumpDisassemble::OnOpcodeUint32Uint32(uint32_t value,
799799
uint32_t value2) {
800-
if (!in_function_body)
800+
if (!in_function_body) {
801801
return Result::Ok;
802+
}
802803
std::string_view name;
803804
if (current_opcode == Opcode::MemoryInit &&
804805
!(name = GetSegmentName(value)).empty()) {
@@ -813,6 +814,9 @@ Result BinaryReaderObjdumpDisassemble::OnOpcodeUint32Uint32(uint32_t value,
813814
Result BinaryReaderObjdumpDisassemble::OnCallIndirectExpr(
814815
uint32_t sig_index,
815816
uint32_t table_index) {
817+
if (!in_function_body) {
818+
return Result::Ok;
819+
}
816820
std::string_view table_name = GetTableName(table_index);
817821
std::string_view type_name = GetTypeName(sig_index);
818822
if (!type_name.empty() && !table_name.empty()) {
Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
;;; TOOL: run-objdump-gen-wasm
2+
;;; ARGS1: -x
3+
magic
4+
version
5+
section(GLOBAL) {
6+
count[1]
7+
type[i32] mut[0] init_expr[call_indirect 0 0 end]
8+
}
9+
(;; STDOUT ;;;
10+
11+
bad-init-expr-callindirect.wasm: file format wasm 0x1
12+
13+
Section Details:
14+
15+
Global[1]:
16+
- global[0] i32 mutable=0 - init <INVALID>
17+
18+
Code Disassembly:
19+
20+
;;; STDOUT ;;)

0 commit comments

Comments
 (0)