Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-17 07:15:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1243239 - Baldr: tighten signature index check (r=bbouvier)

Browse Source 
--HG--
extra : commitid : 34c7qVI67Q1
This commit is contained in:
Luke Wagner 2016-01-27 09:25:45 -06:00
parent d8112ef98f
commit 8a59303f0c
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/asmjs/Wasm.cpp
View File

@ -312,7 +312,7 @@ DecodeDeclarationSection(JSContext* cx, Decoder& d, ModuleGeneratorData* init)
if (!d.readVarU32(&sigIndex))
return Fail(cx, d, "expected declaration signature index");
if (sigIndex > init->sigs.length())
if (sigIndex >= init->sigs.length())
return Fail(cx, d, "declaration signature index out of range");
init->funcSigs[i] = &init->sigs[sigIndex];

12
js/src/jit-test/tests/wasm/binary.js
View File

@ -108,3 +108,15 @@ wasmEval(toBuf(moduleWithSections([sigSection([{args:[I32Code], ret:VoidCode}])]
assertErrorMessage(() => wasmEval(toBuf(moduleWithSections([sigSection([{args:[], ret:100}])]))), Error, /bad expression type/);
assertErrorMessage(() => wasmEval(toBuf(moduleWithSections([sigSection([{args:[100], ret:VoidCode}])]))), Error, /bad value type/);
function declSection(decls) {
var body = [];
body.push(...varU32(decls.length));
for (var decl of decls)
body.push(...varU32(decl));
return { name: declSectionStr, body };
}
assertThrowsInstanceOf(() => wasmEval(toBuf(moduleWithSections([sigSection([]), declSection([0])]))), Error, /signature index out of range/);
assertThrowsInstanceOf(() => wasmEval(toBuf(moduleWithSections([sigSection([{args:[], ret:VoidCode}]), declSection([1])]))), Error, /signature index out of range/);
wasmEval(toBuf(moduleWithSections([sigSection([{args:[], ret:VoidCode}]), declSection([0])])));