Check buffer size when exposing wasm buffers as ArrayBuffers

Author: jirkamarsik

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/builtins/wasm/JSWebAssemblyMemoryObject.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2020, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * The Universal Permissive License (UPL), Version 1.0
@@ -42,7 +42,9 @@
 
 import java.nio.ByteBuffer;
 
+import com.oracle.truffle.api.CompilerDirectives.TruffleBoundary;
 import com.oracle.truffle.api.interop.InteropLibrary;
+import com.oracle.truffle.api.interop.UnsupportedMessageException;
 import com.oracle.truffle.api.object.Shape;
 import com.oracle.truffle.api.strings.TruffleString;
 import com.oracle.truffle.js.runtime.Errors;
@@ -74,22 +76,38 @@ public boolean isShared() {
         return shared;
     }
 
-    public JSArrayBufferObject getBufferObject(JSContext context, JSRealm realm) {
-        if (bufferObject == null) {
-            if (!shared) {
-                bufferObject = JSArrayBuffer.createInteropArrayBuffer(context, realm, wasmMemory);
-            } else {
-                synchronized (wasmMemory) {
-                    InteropLibrary lib = InteropLibrary.getUncached();
-                    ByteBuffer buffer = JSInteropUtil.foreignInteropBufferAsByteBuffer(wasmMemory, lib, realm);
-                    bufferObject = JSSharedArrayBuffer.createSharedArrayBuffer(context, realm, buffer);
-                    boolean status = bufferObject.setIntegrityLevel(true, false);
-                    if (!status) {
-                        throw Errors.createTypeError("Failed to set integrity level of buffer object");
-                    }
+    @TruffleBoundary
+    private JSArrayBufferObject createBufferObject(JSContext context, JSRealm realm) {
+        InteropLibrary lib = InteropLibrary.getUncached();
+        try {
+            if (lib.getBufferSize(wasmMemory) > Integer.MAX_VALUE) {
+                throw Errors.createRangeErrorInvalidBufferSize();
+            }
+        } catch (UnsupportedMessageException e) {
+            throw Errors.createTypeErrorInteropException(wasmMemory, e, "WebAssembly.Memory underlying buffer object is not an interop buffer", null);
+        }
+        if (!shared) {
+            return JSArrayBuffer.createInteropArrayBuffer(context, realm, wasmMemory);
+        } else {
+            synchronized (wasmMemory) {
+                ByteBuffer buffer = JSInteropUtil.foreignInteropBufferAsByteBuffer(wasmMemory, lib, realm);
+                if (buffer == null) {
+                    throw Errors.createTypeError("No ByteBuffer exposed from WebAssembly memory");
+                }
+                JSArrayBufferObject bufferObj = JSSharedArrayBuffer.createSharedArrayBuffer(context, realm, buffer);
+                boolean status = bufferObj.setIntegrityLevel(true, false);
+                if (!status) {
+                    throw Errors.createTypeError("Failed to set integrity level of buffer object");
                 }
+                return bufferObj;
             }
         }
+    }
+
+    public JSArrayBufferObject getBufferObject(JSContext context, JSRealm realm) {
+        if (bufferObject == null) {
+            bufferObject = createBufferObject(context, realm);
+        }
         return bufferObject;
     }
 

graal-js/test/testV8.json

@@ -5721,19 +5721,26 @@
   }, {
     "filePath" : "mjsunit/wasm/memory_1gb_oob.js",
     "status" : "SKIP",
-    "comment" : "long-running test, deactivated"
+    "statusOverrides" : {
+      "POLYGLOT" : "PASS"
+    },
+    "runInIsolation" : true
   }, {
     "filePath" : "mjsunit/wasm/memory_2gb_oob.js",
     "status" : "SKIP",
     "statusOverrides" : {
-      "POLYGLOT" : "PASS"
-    }
+      "POLYGLOT" : "FAIL"
+    },
+    "runInIsolation" : true,
+    "comment" : "Fails when trying to access the underlying ArrayBuffer of a WebAssembly.Memory. This is because GraalJS ArrayBuffers are currently capped at 2GB (- 1 byte) and this test exercises 2GB large memories."
   }, {
     "filePath" : "mjsunit/wasm/memory_4gb_oob.js",
     "status" : "SKIP",
     "statusOverrides" : {
-      "POLYGLOT" : "PASS"
-    }
+      "POLYGLOT" : "FAIL"
+    },
+    "runInIsolation" : true,
+    "comment" : "Fails when trying to access the underlying ArrayBuffer of a WebAssembly.Memory. This is because GraalJS ArrayBuffers are currently capped at 2GB (- 1 byte) and this test exercises 4GB large memories."
   }, {
     "filePath" : "mjsunit/wasm/module-memory.js",
     "status" : "SKIP",