More strictly check bounds in FACT trampolines #13027
Merged
alexcrichton merged 1 commit intobytecodealliance:mainfrom Apr 9, 2026
Merged
More strictly check bounds in FACT trampolines #13027alexcrichton merged 1 commit intobytecodealliance:mainfrom
alexcrichton merged 1 commit intobytecodealliance:mainfrom
Conversation
cfallin
approved these changes
Apr 9, 2026
This commit is a hardening of the various in-bounds checks and such of the FACT compiler, in particular as related to strings. The previous implementation would check bounds in a few places but this was a bit ad-hoc and not uniformly done. There's no known issue with the prior checks, but given the sensitive nature of these checks I feel it's best to make this a bit more rigorous. Specifically the `malloc` helpers, and a newly added `realloc` helper, will internally verify not only alignment but additionally the size of the allocation itself. All manual invocations of `realloc` are switched over to this helper. Additionally all conversion of a guest pointer to a more structured value now additionally goes through helpers which performs these same checks to ensure that everything is in-bounds. The net result is that this should have no behavior change from before. A suite of tests are added for behavior around large strings, specifically exercising the maximum allowable size of strings. This uncovered a few minor issues in transcoding where spec-wise Wasmtime previously transcoded too many bytes before performing a growing `realloc`. Finally a few refactorings were done in FACT to handle some helpers going away, notably around translating the `map<K, V>` type, which cleans up the internals as well.
dfcabd9 to
6670c2a
Compare
alexcrichton
added a commit
to alexcrichton/wasmtime
that referenced
this pull request
Apr 12, 2026
This was originally included in bytecodealliance#12972 but was accidentally lost during the refactorings of bytecodealliance#13027. This re-adds it back in.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This commit is a hardening of the various in-bounds checks and such of
the FACT compiler, in particular as related to strings. The previous
implementation would check bounds in a few places but this was a bit
ad-hoc and not uniformly done. There's no known issue with the prior
checks, but given the sensitive nature of these checks I feel it's best
to make this a bit more rigorous.
Specifically the
mallochelpers, and a newly addedreallochelper,will internally verify not only alignment but additionally the size of
the allocation itself. All manual invocations of
reallocare switchedover to this helper. Additionally all conversion of a guest pointer to a
more structured value now additionally goes through helpers which
performs these same checks to ensure that everything is in-bounds.
The net result is that this should have no behavior change from before.
A suite of tests are added for behavior around large strings,
specifically exercising the maximum allowable size of strings. This
uncovered a few minor issues in transcoding where spec-wise Wasmtime
previously transcoded too many bytes before performing a
growing
realloc.Finally a few refactorings were done in FACT to handle some helpers
going away, notably around translating the
map<K, V>type, whichcleans up the internals as well.