Skip to content

Commit 928598f

Browse files
authored
add heap-type check for GC when ref.null (#4300)
- According to [Link 1](https://webassembly.github.io/gc/core/valid/instructions.html#xref-syntax-instructions-syntax-instr-ref-mathsf-ref-null-mathit-ht), we must ensure that the heap type is valid when ref.null. - According to [Link 2](https://webassembly.github.io/gc/core/valid/types.html#heap-types), a heap type is considered valid if it is either a concrete heap type or an abstract heap type. However, in this function, the check for abstract heap types (absheaptype) was clearly missing, so this condition needs to be added explicitly in the if statement. - When GC is disabled, no change is needed. - When GC is enabled, heap types in WAMR are LEB-encoded values ([Link 3](https://webassembly.github.io/gc/core/appendix/index-types.html)). Therefore, we must use read_leb_int32 to parse the heap type correctly. And we can compute the original type1 using type1 = (uint8)((int32)0x80 + heap_type);.
1 parent c932597 commit 928598f

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

core/iwasm/interpreter/wasm_loader.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -831,19 +831,24 @@ load_init_expr(WASMModule *module, const uint8 **p_buf, const uint8 *buf_end,
831831
{
832832
uint8 type1;
833833

834+
#if WASM_ENABLE_GC == 0
834835
CHECK_BUF(p, p_end, 1);
835836
type1 = read_uint8(p);
836837

837-
#if WASM_ENABLE_GC == 0
838838
cur_value.ref_index = NULL_REF;
839839
if (!push_const_expr_stack(&const_expr_ctx, flag, type1,
840840
&cur_value, error_buf,
841841
error_buf_size))
842842
goto fail;
843843
#else
844+
int32 heap_type;
845+
read_leb_int32(p, p_end, heap_type);
846+
type1 = (uint8)((int32)0x80 + heap_type);
847+
844848
cur_value.gc_obj = NULL_REF;
845849

846850
if (!is_byte_a_type(type1)
851+
|| !wasm_is_valid_heap_type(heap_type)
847852
|| wasm_is_type_multi_byte_type(type1)) {
848853
p--;
849854
read_leb_uint32(p, p_end, type_idx);

0 commit comments

Comments
 (0)