add bounds checking to prevent ref_type_map_count

kylo5aby · kylo5aby · commit f8d5de8e5aa6 · 2025-08-07T18:01:37.000+08:00
Signed-off-by: zhenweijin &lt;zhenwei.jin@intel.com&gt;
diff --git a/core/iwasm/interpreter/wasm_loader.c b/core/iwasm/interpreter/wasm_loader.c
@@ -3959,6 +3959,11 @@ load_function_section(const uint8 *buf, const uint8 *buf_end,
                           total_size, error_buf, error_buf_size))) {
                     return false;
                 }
+                if (ref_type_map_count > UINT16_MAX) {
+                    set_error_buf(error_buf, error_buf_size,
+                                  "local count too large");
+                    return false;
+                }
                 func->local_ref_type_map_count = ref_type_map_count;
             }
 #endif

Original file line number	Diff line number	Diff line change
`@@ -3959,6 +3959,11 @@ load_function_section(const uint8 buf, const uint8 buf_end,`
`3959`	`3959`	`total_size, error_buf, error_buf_size))) {`
`3960`	`3960`	`return false;`
`3961`	`3961`	`}`
	`3962`	`+ if (ref_type_map_count > UINT16_MAX) {`
	`3963`	`+ set_error_buf(error_buf, error_buf_size,`
	`3964`	`+ "local count too large");`
	`3965`	`+ return false;`
	`3966`	`+ }`
`3962`	`3967`	`func->local_ref_type_map_count = ref_type_map_count;`
`3963`	`3968`	`}`
`3964`	`3969`	`#endif`