be4173af81
The throw and try_table validators looked up the tag referenced by the instruction, then indexed m_context.types with the tag's type index without checking it was in range. validate(TagIndex) only validates the tag index itself, and the tag section is validated after the code section, so a module whose tag carries an out-of-range type index reached the unchecked m_context.types[...] access and tripped a Vector bounds assertion during validation. Any WebAssembly.compile() of such a module aborts the WebContent process. Validate the tag's type index before using it, the same check validate(TagType) already performs. |
||
|---|---|---|
| .. | ||
| AbstractMachine.cpp | ||
| AbstractMachine.h | ||
| BytecodeInterpreter.cpp | ||
| BytecodeInterpreter.h | ||
| Configuration.cpp | ||
| Configuration.h | ||
| Interpreter.h | ||
| Operators.h | ||
| Validator.cpp | ||
| Validator.h | ||