From 2c0f6df123a172cd384d6840fda39d485e1b7ad5 Mon Sep 17 00:00:00 2001 From: zhenweijin Date: Fri, 8 Aug 2025 14:40:54 +0800 Subject: [PATCH] fix potential overflow in memory size calculation Signed-off-by: zhenweijin --- core/iwasm/aot/aot_runtime.c | 6 +++--- core/iwasm/interpreter/wasm_runtime.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/core/iwasm/aot/aot_runtime.c b/core/iwasm/aot/aot_runtime.c index d2621fb2fa..4cd8758cfd 100644 --- a/core/iwasm/aot/aot_runtime.c +++ b/core/iwasm/aot/aot_runtime.c @@ -1026,14 +1026,14 @@ memory_instantiate(AOTModuleInstance *module_inst, AOTModuleInstance *parent, /* If only one page and at most one page, we just append the app heap to the end of linear memory, enlarge the num_bytes_per_page, and don't change the page count */ - heap_offset = num_bytes_per_page; - num_bytes_per_page += heap_size; - if (num_bytes_per_page < heap_size) { + if (heap_size > UINT32_MAX - num_bytes_per_page) { set_error_buf(error_buf, error_buf_size, "failed to insert app heap into linear memory, " "try using `--heap-size=0` option"); return NULL; } + heap_offset = num_bytes_per_page; + num_bytes_per_page += heap_size; } else if (heap_size > 0) { if (init_page_count == max_page_count && init_page_count == 0) { diff --git a/core/iwasm/interpreter/wasm_runtime.c b/core/iwasm/interpreter/wasm_runtime.c index b4aa483d71..55e65142a7 100644 --- a/core/iwasm/interpreter/wasm_runtime.c +++ b/core/iwasm/interpreter/wasm_runtime.c @@ -335,14 +335,14 @@ memory_instantiate(WASMModuleInstance *module_inst, WASMModuleInstance *parent, /* If only one page and at most one page, we just append the app heap to the end of linear memory, enlarge the num_bytes_per_page, and don't change the page count */ - heap_offset = num_bytes_per_page; - num_bytes_per_page += heap_size; - if (num_bytes_per_page < heap_size) { + if (heap_size > UINT32_MAX - num_bytes_per_page) { set_error_buf(error_buf, error_buf_size, "failed to insert app heap into linear memory, " "try using `--heap-size=0` option"); return NULL; } + heap_offset = num_bytes_per_page; + num_bytes_per_page += heap_size; } else if (heap_size > 0) { if (init_page_count == max_page_count && init_page_count == 0) {