Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing Table Type Validation in call_indirect Instruction #3992

Closed
Q1IQ opened this issue Dec 28, 2024 · 2 comments
Closed

Missing Table Type Validation in call_indirect Instruction #3992

Q1IQ opened this issue Dec 28, 2024 · 2 comments

Comments

@Q1IQ
Copy link

Q1IQ commented Dec 28, 2024

Subject of the issue

iwasm fails to validate the type of the table used in the call_indirect instruction. According to the WebAssembly specification, the table associated with call_indirect must have a funcref type.

Test case

(module
  (type (func (param i32 i32) (result i32)))

  (func $func1 (type 0) (param i32 i32) (result i32)
    local.get 0
    local.get 1
    i32.add)

  (func $func2 (type 0) (param i32 i32) (result i32)
    local.get 0
    local.get 1
    i32.sub)

  (table 2 externref)
  (elem (i32.const 0) $func1 $func2)

  (func $main (result i32)
    i32.const 0x12341234
    i32.const 0x1234
    i32.const 1
    call_indirect (type 0)
    )

  (export "main" (func $main))
)

Your environment

  • OS: Ubuntu 20.04
  • CPU: amd64
  • WAMR version: iwasm 1.2.3
  • Commands:
iwasm  --interp -f main ./program.wasm
iwasm --fast-jit -f main ./program.wasm
iwasm --llvm-jit -f main ./program.wasm
iwasm --multi-tier-jit -f main./program.wasm

Actual behavior

The iwasm proceeds to execute the module without raising any validation error, despite the table having an invalid type (externref) for use in the call_indirect instruction. The observed output in all execution modes is:

0x12340000:i32

Expected behavior

The WebAssembly specification mandates that the table used in the call_indirect instruction must be of type funcref. Tables of type externref cannot hold function references and are invalid for call_indirect. The runtime should fail validation and report an error similar to:

Validation error: Table 0 must have type 'funcref' to have an element section.
@lum1n0us
Copy link
Collaborator

lum1n0us commented Dec 29, 2024

fail to reproduce the result 0x12340000:i32.


Could you please provide more details?

  • Which build of iwasm are you using? If it's built from source, which branch and commit are you on and your compilation combination?
  • What toolchain are you using to convert .wat files to .wasm?

Here are my steps:

  • Using main branch, commit 04f1071
  • cmake -S . -B build
  • /opt/wabt-1.0.36/bin/wat2wasm --no-check ./test.wat -o test.wasm
  • $ /workspaces/wasm-micro-runtime/product-mini/platforms/linux/build/iwasm -f main ./test.wasm -> WASM module load failed: type mismatch

@Q1IQ
Copy link
Author

Q1IQ commented Dec 30, 2024

fail to reproduce the result 0x12340000:i32.

Could you please provide more details?

  • Which build of iwasm are you using? If it's built from source, which branch and commit are you on and your compilation combination?
  • What toolchain are you using to convert .wat files to .wasm?

Here are my steps:

  • Using main branch, commit 04f1071
  • cmake -S . -B build
  • /opt/wabt-1.0.36/bin/wat2wasm --no-check ./test.wat -o test.wasm
  • $ /workspaces/wasm-micro-runtime/product-mini/platforms/linux/build/iwasm -f main ./test.wasm -> WASM module load failed: type mismatch

I used your version to reproduce this report and updated it in the issue 3993

@Q1IQ Q1IQ closed this as not planned Won't fix, can't repro, duplicate, stale Dec 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants