Out of bound array access in binding generation

[landonxjames]

Problem

I am currently working on an example of how to use the AWS Rust SDK in a WASM component. As part of this example I am using jco and wasmtime-py to build bindings to the component in different languages. The JS bindings build as expected, but attempting to build python bindings with wasmtime = 33.0.0 fails with the following error:

$ python -m wasmtime.bindgen ./target/wasm32-wasip1/release/aws_sdk_wasi_example.wasm --out-dir py-bindings/

thread '<unnamed>' panicked at src/bindgen.rs:683:44:
index out of bounds: the len is 4 but the index is 15
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "/Users/lnj/.pyenv/versions/3.11.4/lib/python3.11/site-packages/wasmtime/bindgen/__main__.py", line 40, in <module>
    main()
  File "/Users/lnj/.pyenv/versions/3.11.4/lib/python3.11/site-packages/wasmtime/bindgen/__main__.py", line 30, in main
    files = generate(name, contents)
            ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/lnj/.pyenv/versions/3.11.4/lib/python3.11/site-packages/wasmtime/bindgen/__init__.py", line 151, in generate
    result = root.generate(store, name, component)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/lnj/.pyenv/versions/3.11.4/lib/python3.11/site-packages/wasmtime/bindgen/generated/__init__.py", line 301, in generate
    ret = self.lift_callee0(caller, ptr, len0, ptr1, len2)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/lnj/.pyenv/versions/3.11.4/lib/python3.11/site-packages/wasmtime/_func.py", line 93, in __call__
    with enter_wasm(store) as trap:
  File "/Users/lnj/.pyenv/versions/3.11.4/lib/python3.11/contextlib.py", line 144, in __exit__
    next(self.gen)
  File "/Users/lnj/.pyenv/versions/3.11.4/lib/python3.11/site-packages/wasmtime/_func.py", line 265, in enter_wasm
    raise trap_obj
wasmtime._trap.Trap: error while executing at wasm backtrace:
    0: 0x32d158 - bindgen.wasm!__rust_start_panic
    1: 0x32cfa4 - bindgen.wasm!rust_panic
    2: 0x32ceb9 - bindgen.wasm!std::panicking::rust_panic_with_hook::h79071f5fb265d1d9
    3: 0x32be57 - bindgen.wasm!std::panicking::begin_panic_handler::{{closure}}::h410c57f452410813
    4: 0x32bdc3 - bindgen.wasm!std::sys::backtrace::__rust_end_short_backtrace::h514500abf2a2d0ca
    5: 0x32c84d - bindgen.wasm!rust_begin_unwind
    6: 0x33ecda - bindgen.wasm!core::panicking::panic_fmt::he306018bf71f8e67
    7: 0x339fb8 - bindgen.wasm!core::panicking::panic_bounds_check::h37498674ddc92076
    8:   0xe9ef - bindgen.wasm!bindgen::bindgen::Instantiator::ensure_resource_table::h9c664fb5e7f9282c
    9:   0xb114 - bindgen.wasm!bindgen::bindgen::WasmtimePy::instantiate::haada3a4d72c506c7
   10:   0x7f4f - bindgen.wasm!bindgen::bindgen::WasmtimePy::generate::h271c4732caf2a808
   11:  0x41c87 - bindgen.wasm!<bindgen::bindings::PythonBindings as bindgen::bindings::Guest>::generate::h5991088c20d1b3ad
   12:  0x41e32 - bindgen.wasm!generate

Caused by:
    wasm trap: wasm `unreachable` instruction executed

Poking around the code where it panicked:

wasmtime-py/rust/src/bindgen.rs

Lines 683 to 685 in 31c3457

	if self.resource_tables_initialized[resource_id as usize] {
	return;
	}

It appears to be looking up an entry to confirm if a resource has been initialized, and my model does contain a resource, so I suspect there is some relation there. I will continue poking around to see what I else I can figure out.

Steps to Reproduce

All code and the WIT model are contained in this repo https://github.com/landonxjames/aws-sdk-wasi-example

To reproduce running the following should be enough:

git clone https://github.com/landonxjames/aws-sdk-wasi-example.git
cd aws-sdk-wasi-example
cargo component build --release
pip install -r requirements.txt
python -m wasmtime.bindgen ./target/wasm32-wasip1/release/aws_sdk_wasi_example.wasm --out-dir py-bindings/

Versions of relevant tools

cargo 1.86.0 (adf9b6ad1 2025-02-28)

cargo-component-component 0.21.1

wasmtime==33.0.0

Python 3.11.4

[landonxjames]

Throwing some logging in and looking at the WAT I think I have a better grasp of what is going on now. My component contains a single resource, but it is using some WASI interfaces (via the wasi crate) which define resources and those don't seem to be accounted for. So when the Instantiator is created:

wasmtime-py/rust/src/bindgen.rs

Lines 347 to 357 in 31c3457

	let mut i = Instantiator {
	name: &world.name,
	gen: self,
	resolve: &resolve,
	modules,
	component,
	world: id,
	instances: PrimaryMap::default(),
	lifts: 0,
	resource_tables_initialized: vec![false; component.num_runtime_instances as usize],
	types,

the resource_tables_initialized vec is too small since the imported WASI resources aren't included. Haven't tracked down why component.num_runtime_instances doesn't seem to be capturing all of the resources.

[alexcrichton]

Oof I was worried about this in this update and was wondering if that was the right translation I did... Definitely not!

I don't have time at the moment to work on this but would be happy to help review/merge a PR for a fix. The fix is going to be somewhat subtle though I think because the way tables are modeled changed in Wasmtime which means that some more deep refactorings of the Python bits are going to be required I think.