Bound check in the instruction `memory.init`

[erxiaozhou]

Test Case

memory_init_0_9_0.zip

Steps to Reproduce

/home/zph/CP912/wasmtime/install/bin/wasmtime run <path_of_the__test_case> --invoke to_test

Expected Results

No exception

Actual Results

An exception indicating "Memory OOB"

Error: failed to run main module `<path_to_the_test_case>`

Caused by:
    0: failed to invoke `to_test`
    1: error while executing at wasm backtrace:
           0:  0x13f - <unknown>!<wasm function 0>
    2: wasm trap: out of bounds memory access

Versions and Environment

Wasmtime version or commit: 37300d3

Operating system: ubuntu 20.04

Architecture: x86_64

Extra Info

According to the specification, there should not be an exception, because here s+n=9, is not larger than the length of data.data and d+n=0, is smaller than the length of mem.data .

[fitzgen]

WAT disassembly of the test case

(module
  (type (;0;) (func (param i32 i32 i32 i32) (result i32)))
  (type (;1;) (func (param i32)))
  (type (;2;) (func))
  (type (;3;) (func (result i32)))
  (func (;0;) (type 2)
    (local i32 f32 i64 f64)
    i32.const 0
    i32.const 9
    i32.const 0
    memory.init 2)
  (func (;1;) (type 3) (result i32)
    i32.const 1
    i32.const 3
    i32.add)
  (func (;2;) (type 3) (result i32)
    i32.const 2
    i32.const 3
    i32.add)
  (func (;3;) (type 3) (result i32)
    i32.const 3
    i32.const 3
    i32.add)
  (table (;0;) 10 20 funcref)
  (memory (;0;) 1 5)
  (global (;0;) i32 (i32.const 541))
  (global (;1;) (mut i32) (i32.const 191))
  (global (;2;) f32 (f32.const 0x1.0e8p+9 (;=541;)))
  (global (;3;) (mut f32) (f32.const 0x1.8p+7 (;=192;)))
  (global (;4;) i64 (i64.const 54))
  (global (;5;) (mut i64) (i64.const 19))
  (global (;6;) f64 (f64.const 0x1.bp+5 (;=54;)))
  (global (;7;) (mut f64) (f64.const 0x1.3p+4 (;=19;)))
  (global (;8;) (mut i32) (i32.const 0))
  (global (;9;) (mut f32) (f32.const 0x0p+0 (;=0;)))
  (global (;10;) (mut i64) (i64.const 0))
  (global (;11;) (mut f64) (f64.const 0x0p+0 (;=0;)))
  (global (;12;) (mut f32) (f32.const 0x1.566586p-55 (;=3.71227e-17;)))
  (global (;13;) (mut i64) (i64.const -7377836612904162111))
  (global (;14;) (mut i32) (i32.const 32562))
  (global (;15;) (mut f32) (f32.const 0x1.566586p-55 (;=3.71227e-17;)))
  (global (;16;) (mut i64) (i64.const -7377836612904162111))
  (global (;17;) (mut i32) (i32.const 32562))
  (global (;18;) (mut f64) (f64.const 0x1.664c806fbc53dp+822 (;=3.91437e+247;)))
  (global (;19;) (mut f64) (f64.const 0x1.664c806fbc53dp+822 (;=3.91437e+247;)))
  (export "_start" (func 0))
  (export "to_test" (func 0))
  (elem (;0;) (i32.const 0) func 1 2 3 0 1)
  (elem (;1;) (i32.const 5) func 3 3 2 1)
  (elem (;2;) (i32.const 9) func 0)
  (data (;0;) (i32.const 8) "\01\02\03\04\05\06\07\08")
  (data (;1;) (i32.const 16) "\01\02\03\04\05\06\07\08\ff")
  (data (;2;) (i32.const 32) "\01\02\03\04\05\06\07\08\ff"))

[fitzgen]

Reduced test case:

(module
  (type (;0;) (func))
  (func (;0;) (type 0)
    (local i32 f32 i64 f64)
    i32.const 0
    i32.const 9
    i32.const 0
    memory.init 2
  )
  (memory (;0;) 1 5)
  (export "_start" (func 0))
  (data (;0;) (i32.const 8) "")
  (data (;1;) (i32.const 16) "")
  (data (;2;) (i32.const 32) "\01\02\03\04\05\06\07\08\ff")
)

[alexcrichton]

Thanks for the report! I think though that this is working as intended, the data segment being used here is an "active data segment" which implicitly gets a data.drop during module instantiation, meaning that the data segment has length 0 by the time memory.init is executed at which point the offset of 9 is out-of-bounds.

[fitzgen]

I believe Alex's interpretation is correct, closing.

[fitzgen]

@erxiaozhou thanks for filing this bug report! In the future, you can make the bug reports even more helpful by reducing the test case before filing an issue. I've filed a PR documenting how that is done here: #7780