Skip to content

fix: use copy of input for wasm_runtime_load to fix overwrites-const-input in fuzz #4869

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kylo5aby wants to merge 1 commit into
base: main
Choose a base branch
from
+11 −7
Open

fix: use copy of input for wasm_runtime_load to fix overwrites-const-input in fuzz #4869

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions tests/fuzz/wasm-mutator-fuzz/aot-compiler/aot_compiler_fuzz.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,18 +39,20 @@ LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
wasm_module_t aot_module = NULL;
wasm_module_inst_t inst = NULL;

/* libfuzzer don't allow to modify the given Data, but get_package_type and
* wasm_runtime_load only read the data, so we can safely use const_cast */
/* wasm_runtime_load may modify the input buffer in-place,
* so we must work on a copy to avoid overwriting libFuzzer's const input */
std::vector<uint8_t> data_copy(Data, Data + Size);

if (Size >= 4
&& get_package_type(const_cast<uint8_t *>(Data), Size)
&& get_package_type(data_copy.data(), Size)
!= Wasm_Module_Bytecode) {
printf("Invalid wasm file: magic header not detected\n");
return 0;
}

wasm_runtime_init();

module = wasm_runtime_load(const_cast<uint8_t *>(Data), Size, error_buf,
module = wasm_runtime_load(data_copy.data(), Size, error_buf,
MAX_ERROR_BUF_SIZE);
if (!module) {
std::cout << "[LOADING] " << error_buf << std::endl;
Expand Down
8 changes: 5 additions & 3 deletions tests/fuzz/wasm-mutator-fuzz/wasm-mutator/wasm_mutator_fuzz.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,13 +15,15 @@ using namespace std;
extern "C" int
LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
{
/* libfuzzer don't allow us to modify the given Data, but wasm_runtime_load
* only reads the data, so we can safely use const_cast */
/* wasm_runtime_load may modify the input buffer in-place,
* so we must work on a copy to avoid overwriting libFuzzer's const input */
std::vector<uint8_t> data_copy(Data, Data + Size);

/* init runtime environment */
wasm_runtime_init();

char error_buf[ERROR_BUF_SIZE] = { 0 };
wasm_module_t module = wasm_runtime_load(const_cast<uint8_t *>(Data), Size,
wasm_module_t module = wasm_runtime_load(data_copy.data(), Size,
error_buf, MAX_ERROR_BUF_SIZE);
if (!module) {
std::cout << "[LOADING] " << error_buf << std::endl;
Expand Down