christoph/wamr
1
Fork 0
Code Releases Activity

Fix a leak in wasm_loader_emit_br_info (#3900)

Browse Source 
Reference Info: 377955855 wamr:wasm_mutator_fuzz_loader: Direct-leak in wasm_loader_emit_br_info

https://issues.oss-fuzz.com/issues/377955855
This commit is contained in:
TianlongLiang
2024-11-13 15:16:13 +08:00
committed by GitHub
parent 226bf22f9e
commit 0e4dffc479
3 changed files with 24 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
core/iwasm/interpreter/wasm_loader.c
View File

@ -9885,13 +9885,6 @@ fail:
}
#endif /* WASM_ENABLE_FAST_INTERP */
#define RESERVE_BLOCK_RET() \
do { \
if (!reserve_block_ret(loader_ctx, opcode, disable_emit, error_buf, \
error_buf_size)) \
goto fail; \
} while (0)
#define PUSH_TYPE(type) \
do { \
if (!(wasm_loader_push_frame_ref(loader_ctx, type, error_buf, \
@ -11612,7 +11605,10 @@ re_scan:
#if WASM_ENABLE_FAST_INTERP != 0
/* if the result of if branch is in local or const area, add a
* copy op */
RESERVE_BLOCK_RET();
if (!reserve_block_ret(loader_ctx, opcode, disable_emit,
error_buf, error_buf_size)) {
goto fail;
}
emit_empty_label_addr_and_frame_ip(PATCH_END);
apply_label_patch(loader_ctx, 1, PATCH_ELSE);
@ -11672,7 +11668,15 @@ re_scan:
#if WASM_ENABLE_FAST_INTERP != 0
skip_label();
/* copy the result to the block return address */
RESERVE_BLOCK_RET();
if (!reserve_block_ret(loader_ctx, opcode, disable_emit,
error_buf, error_buf_size)) {
/* it could be tmp frame_csp allocated from opcode like
* OP_BR and not counted in loader_ctx->csp_num, it won't
* be freed in wasm_loader_ctx_destroy(loader_ctx) so need
* to free the loader_ctx->frame_csp if fails */
free_label_patch_list(loader_ctx->frame_csp);
goto fail;
}
apply_label_patch(loader_ctx, 0, PATCH_END);
free_label_patch_list(loader_ctx->frame_csp);