diff --git a/core/iwasm/aot/aot_runtime.c b/core/iwasm/aot/aot_runtime.c index 28db2878..81120db9 100644 --- a/core/iwasm/aot/aot_runtime.c +++ b/core/iwasm/aot/aot_runtime.c @@ -1770,10 +1770,7 @@ aot_module_malloc(AOTModuleInstance *module_inst, uint32 size, if (!addr) { if (memory_inst->heap_handle.ptr && mem_allocator_is_heap_corrupted(memory_inst->heap_handle.ptr)) { - LOG_ERROR("Error: app heap is corrupted, if the wasm file " - "is compiled by wasi-sdk-12.0 or larger version, " - "please add -Wl,--export=malloc -Wl,--export=free " - " to export malloc and free functions."); + wasm_runtime_show_app_heap_corrupted_prompt(); aot_set_exception(module_inst, "app heap corrupted"); } else { @@ -2014,6 +2011,7 @@ aot_enlarge_memory(AOTModuleInstance *module_inst, uint32 inc_page_count) uint32 total_page_count, total_size_old, heap_size; uint64 total_size; uint8 *memory_data_old, *heap_data_old, *memory_data, *heap_data; + bool ret = true; if (!memory_inst) return false; @@ -2051,6 +2049,13 @@ aot_enlarge_memory(AOTModuleInstance *module_inst, uint32 inc_page_count) } #endif + if (heap_size > 0) { + if (mem_allocator_is_heap_corrupted(memory_inst->heap_handle.ptr)) { + wasm_runtime_show_app_heap_corrupted_prompt(); + return false; + } + } + if (!(memory_data = wasm_runtime_realloc(memory_data_old, (uint32)total_size))) { if (!(memory_data = wasm_runtime_malloc((uint32)total_size))) { @@ -2076,7 +2081,9 @@ aot_enlarge_memory(AOTModuleInstance *module_inst, uint32 inc_page_count) (char *)heap_data_old + (memory_data - memory_data_old), heap_size)) { - return false; + /* Don't return here as memory->memory_data is obsolete and + must be updated to be correctly used later. */ + ret = false; } } @@ -2098,7 +2105,7 @@ aot_enlarge_memory(AOTModuleInstance *module_inst, uint32 inc_page_count) memory_inst->mem_bound_check_8bytes.u32[0] = (uint32)total_size - 8; memory_inst->mem_bound_check_16bytes.u32[0] = (uint32)total_size - 16; } - return true; + return ret; } #else /* else of OS_ENABLE_HW_BOUND_CHECK */ bool diff --git a/core/iwasm/common/wasm_runtime_common.c b/core/iwasm/common/wasm_runtime_common.c index 286c2200..6402a51b 100644 --- a/core/iwasm/common/wasm_runtime_common.c +++ b/core/iwasm/common/wasm_runtime_common.c @@ -4211,3 +4211,14 @@ fail: wasm_runtime_free(results); return ret; } + +void +wasm_runtime_show_app_heap_corrupted_prompt() +{ + LOG_ERROR("Error: app heap is corrupted, if the wasm file " + "is compiled by wasi-sdk-12.0 or higher version, " + "please add -Wl,--export=malloc -Wl,--export=free " + "to export malloc and free functions. If it is " + "compiled by asc, please add --exportRuntime to " + "export the runtime helpers."); +} diff --git a/core/iwasm/common/wasm_runtime_common.h b/core/iwasm/common/wasm_runtime_common.h index b115a8a1..483bf944 100644 --- a/core/iwasm/common/wasm_runtime_common.h +++ b/core/iwasm/common/wasm_runtime_common.h @@ -839,6 +839,9 @@ wasm_runtime_invoke_c_api_native(WASMModuleInstanceCommon *module_inst, uint32 argc, uint32 *argv, bool with_env, void *wasm_c_api_env); +void +wasm_runtime_show_app_heap_corrupted_prompt(); + #ifdef __cplusplus } #endif diff --git a/core/iwasm/interpreter/wasm_runtime.c b/core/iwasm/interpreter/wasm_runtime.c index 372d572f..7574a3f8 100644 --- a/core/iwasm/interpreter/wasm_runtime.c +++ b/core/iwasm/interpreter/wasm_runtime.c @@ -1826,10 +1826,7 @@ wasm_module_malloc(WASMModuleInstance *module_inst, uint32 size, if (!addr) { if (memory->heap_handle && mem_allocator_is_heap_corrupted(memory->heap_handle)) { - LOG_ERROR("Error: app heap is corrupted, if the wasm file " - "is compiled by wasi-sdk-12.0 or larger version, " - "please add -Wl,--export=malloc -Wl,--export=free " - " to export malloc and free functions."); + wasm_runtime_show_app_heap_corrupted_prompt(); wasm_set_exception(module_inst, "app heap corrupted"); } else { @@ -2057,6 +2054,7 @@ wasm_enlarge_memory(WASMModuleInstance *module, uint32 inc_page_count) uint8 *new_memory_data, *memory_data, *heap_data_old; uint32 heap_size, total_size_old, total_page_count; uint64 total_size; + bool ret = true; if (!memory) return false; @@ -2090,6 +2088,13 @@ wasm_enlarge_memory(WASMModuleInstance *module, uint32 inc_page_count) } #endif + if (heap_size > 0) { + if (mem_allocator_is_heap_corrupted(memory->heap_handle)) { + wasm_runtime_show_app_heap_corrupted_prompt(); + return false; + } + } + if (!(new_memory_data = wasm_runtime_realloc(memory_data, (uint32)total_size))) { if (!(new_memory_data = wasm_runtime_malloc((uint32)total_size))) { @@ -2111,7 +2116,9 @@ wasm_enlarge_memory(WASMModuleInstance *module, uint32 inc_page_count) + (new_memory_data - memory_data), heap_size) != 0) { - return false; + /* Don't return here as memory->memory_data is obsolete and + must be updated to be correctly used later. */ + ret = false; } } @@ -2122,7 +2129,7 @@ wasm_enlarge_memory(WASMModuleInstance *module, uint32 inc_page_count) memory->memory_data_end = memory->memory_data + memory->num_bytes_per_page * total_page_count; - return true; + return ret; } #if WASM_ENABLE_REF_TYPES != 0 diff --git a/core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/include/wasmtime_ssp.h b/core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/include/wasmtime_ssp.h index ace66163..297d0c50 100644 --- a/core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/include/wasmtime_ssp.h +++ b/core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/include/wasmtime_ssp.h @@ -9,6 +9,12 @@ * around to avoid storing them in TLS. */ +/** + * The defitions of type, macro and structure in this file should be + * consistent with those in wasi-libc: + * https://github.com/WebAssembly/wasi-libc/blob/main/libc-bottom-half/headers/public/wasi/api.h + */ + #ifndef WASMTIME_SSP_H #define WASMTIME_SSP_H @@ -201,8 +207,10 @@ typedef uint16_t __wasi_riflags_t; typedef uint64_t __wasi_rights_t; -// Observe that WASI defines rights in the plural form -// TODO - re-factor to use RIGHTS instead of RIGHT +/** + * Observe that WASI defines rights in the plural form + * TODO: refactor to use RIGHTS instead of RIGHT + */ #define __WASI_RIGHT_FD_DATASYNC ((__wasi_rights_t)(1 << 0)) #define __WASI_RIGHT_FD_READ ((__wasi_rights_t)(1 << 1)) #define __WASI_RIGHT_FD_SEEK ((__wasi_rights_t)(1 << 2)) diff --git a/core/shared/mem-alloc/ems/ems_alloc.c b/core/shared/mem-alloc/ems/ems_alloc.c index 1d432a76..a342bb5e 100644 --- a/core/shared/mem-alloc/ems/ems_alloc.c +++ b/core/shared/mem-alloc/ems/ems_alloc.c @@ -235,12 +235,12 @@ gci_add_fc(gc_heap_t *heap, hmu_t *hmu, gc_size_t size) return true; } - /* big block*/ + /* big block */ node = (hmu_tree_node_t *)hmu; node->size = size; node->left = node->right = node->parent = NULL; - /* find proper node to link this new node to*/ + /* find proper node to link this new node to */ root = &heap->kfc_tree_root; tp = root; bh_assert(tp->size < size); @@ -253,7 +253,7 @@ gci_add_fc(gc_heap_t *heap, hmu_t *hmu, gc_size_t size) } tp = tp->right; } - else { /* tp->size >= size*/ + else { /* tp->size >= size */ if (!tp->left) { tp->left = node; node->parent = tp; @@ -759,7 +759,7 @@ gci_dump(gc_heap_t *heap) else if (ut == HMU_FC) inuse = 'F'; - if (size == 0) { + if (size == 0 || size > (uint8 *)end - (uint8 *)cur) { os_printf("[GC_ERROR]Heap is corrupted, heap dump failed.\n"); heap->is_heap_corrupted = true; return; @@ -779,5 +779,8 @@ gci_dump(gc_heap_t *heap) i++; } - bh_assert(cur == end); + if (cur != end) { + os_printf("[GC_ERROR]Heap is corrupted, heap dump failed.\n"); + heap->is_heap_corrupted = true; + } } diff --git a/core/shared/mem-alloc/ems/ems_kfc.c b/core/shared/mem-alloc/ems/ems_kfc.c index e3633993..ee3ecde0 100644 --- a/core/shared/mem-alloc/ems/ems_kfc.c +++ b/core/shared/mem-alloc/ems/ems_kfc.c @@ -183,6 +183,11 @@ gc_migrate(gc_handle_t handle, char *pool_buf_new, gc_size_t pool_buf_size) if (offset == 0) return 0; + if (heap->is_heap_corrupted) { + os_printf("[GC_ERROR]Heap is corrupted, heap migrate failed.\n"); + return GC_ERROR; + } + heap->base_addr = (uint8 *)base_addr_new; adjust_ptr((uint8 **)&heap->kfc_tree_root.left, offset); adjust_ptr((uint8 **)&heap->kfc_tree_root.right, offset); @@ -193,7 +198,12 @@ gc_migrate(gc_handle_t handle, char *pool_buf_new, gc_size_t pool_buf_size) while (cur < end) { size = hmu_get_size(cur); - bh_assert(size > 0); + + if (size <= 0 || size > (uint8 *)end - (uint8 *)cur) { + os_printf("[GC_ERROR]Heap is corrupted, heap migrate failed.\n"); + heap->is_heap_corrupted = true; + return GC_ERROR; + } if (hmu_get_ut(cur) == HMU_FC && !HMU_IS_FC_NORMAL(size)) { tree_node = (hmu_tree_node_t *)cur; @@ -207,7 +217,12 @@ gc_migrate(gc_handle_t handle, char *pool_buf_new, gc_size_t pool_buf_size) cur = (hmu_t *)((char *)cur + size); } - bh_assert(cur == end); + if (cur != end) { + os_printf("[GC_ERROR]Heap is corrupted, heap migrate failed.\n"); + heap->is_heap_corrupted = true; + return GC_ERROR; + } + return 0; }