Skip to content

[lightbeam] add overflow in debug mode (backend:store:2136 & backend:store:2159) #738

Closed
@pventuzelo

Description

@pventuzelo

Issue description

An addition with overflow make lightbeam to panic when compiled in debug mode.

$ ./target/debug/debug_lightbeam store_add_overflow_lightbeam.wasm 
thread 'main' panicked at 'attempt to add with overflow', XXX/wasmtime/crates/lightbeam/src/backend.rs:2136:68
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace.

This issue is related to the macro store! when dealing with the i32.store8 opcode:

match runtime_offset {
Ok(imm) => {
dynasm!(ctx.asm
; mov [Rq(mem_ptr_reg.rq().unwrap()) + offset + imm], $int_reg_ty(src_reg.rq().unwrap())
);
}

Reproduction

Download:
store_add_overflow_lightbeam.zip

or wasm2wat store_add_overflow_lightbeam.wasm :

(module
  (type (;0;) (func))
  (func (;0;) (type 0)
    i32.const 2
    i32.const 1
    i32.store8 offset=2147483647)
  (memory (;0;) 1)
  (export "_start" (func 0)))

Testing program (need to be compiled in debug mode i.e. RUSTFLAGS=-g cargo build):

use std::env;
use std::fs::{File};
use std::io;
use std::io::Read;
use std::path::PathBuf;

use wasmtime_fuzzing::oracles;
use wasmtime_jit::CompilationStrategy;
use lightbeam;

/// Read the contents of a file
fn read_contents(path: &PathBuf) -> Result<Vec<u8>, io::Error> {
    let mut buffer: Vec<u8> = Vec::new();
    let mut file = File::open(path)?;
    file.read_to_end(&mut buffer)?;
    drop(file);
    Ok(buffer)
}

fn main() {
	let args: Vec<String> = env::args().collect();
	let wasm_path = std::path::PathBuf::from(&args[1]);
	let wasm_binary: Vec<u8> = read_contents(&wasm_path).unwrap();

    let _res_compile = oracles::compile(&wasm_binary[..], CompilationStrategy::Lightbeam);
    let _res_instantiate = oracles::instantiate(&wasm_binary[..], CompilationStrategy::Lightbeam);
    let _res_translate = lightbeam::translate(&wasm_binary[..]);
}

wasmtime commit: 31472fb

Metadata

Metadata

Assignees

No one assigned

    Labels

    fuzz-bugBugs found by a fuzzerlightbeamIssues related to the Lightbeam compiler

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions