Skip to content

Commit c7df142

Browse files
committed
fix potential overflow in memory size calculation
Signed-off-by: zhenweijin <[email protected]>
1 parent 6b51c61 commit c7df142

File tree

2 files changed

+10
-6
lines changed

2 files changed

+10
-6
lines changed

core/iwasm/aot/aot_runtime.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1026,14 +1026,16 @@ memory_instantiate(AOTModuleInstance *module_inst, AOTModuleInstance *parent,
10261026
/* If only one page and at most one page, we just append
10271027
the app heap to the end of linear memory, enlarge the
10281028
num_bytes_per_page, and don't change the page count */
1029-
heap_offset = num_bytes_per_page;
1030-
num_bytes_per_page += heap_size;
1031-
if (num_bytes_per_page < heap_size) {
1029+
#if WASM_ENABLE_MULTI_MODULE == 0 || WASM_ENABLE_SHARED_MEMORY != 0
1030+
if (heap_size > UINT32_MAX - num_bytes_per_page) {
10321031
set_error_buf(error_buf, error_buf_size,
10331032
"failed to insert app heap into linear memory, "
10341033
"try using `--heap-size=0` option");
10351034
return NULL;
10361035
}
1036+
#endif
1037+
heap_offset = num_bytes_per_page;
1038+
num_bytes_per_page += heap_size;
10371039
}
10381040
else if (heap_size > 0) {
10391041
if (init_page_count == max_page_count && init_page_count == 0) {

core/iwasm/interpreter/wasm_runtime.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -335,14 +335,16 @@ memory_instantiate(WASMModuleInstance *module_inst, WASMModuleInstance *parent,
335335
/* If only one page and at most one page, we just append
336336
the app heap to the end of linear memory, enlarge the
337337
num_bytes_per_page, and don't change the page count */
338-
heap_offset = num_bytes_per_page;
339-
num_bytes_per_page += heap_size;
340-
if (num_bytes_per_page < heap_size) {
338+
#if WASM_ENABLE_MULTI_MODULE == 0 || WASM_ENABLE_SHARED_MEMORY != 0
339+
if (heap_size > UINT32_MAX - num_bytes_per_page) {
341340
set_error_buf(error_buf, error_buf_size,
342341
"failed to insert app heap into linear memory, "
343342
"try using `--heap-size=0` option");
344343
return NULL;
345344
}
345+
#endif
346+
heap_offset = num_bytes_per_page;
347+
num_bytes_per_page += heap_size;
346348
}
347349
else if (heap_size > 0) {
348350
if (init_page_count == max_page_count && init_page_count == 0) {

0 commit comments

Comments
 (0)