[webkit-changes] [WebKit/WebKit] f6a596: ref.null accepts invalid type indices

[Daniel Liu]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: f6a59631fa7d079af7134f69134d66238eaee15d
      https://github.com/WebKit/WebKit/commit/f6a59631fa7d079af7134f69134d66238eaee15d
  Author: Daniel Liu <danlliu at umich.edu>
  Date:   2024-07-08 (Mon, 08 Jul 2024)

  Changed paths:
    M Source/JavaScriptCore/wasm/WasmFormat.h
    M Source/JavaScriptCore/wasm/WasmParser.h

  Log Message:
  -----------
  ref.null accepts invalid type indices
https://bugs.webkit.org/show_bug.cgi?id=276268
rdar://130746860

Reviewed by Mark Lam.

ref.null only checks the low byte due to casting, meaning that invalid indices could be incorrectly treated as valid reference types.

* Source/JavaScriptCore/wasm/WasmFormat.h:
(JSC::Wasm::isValidHeapTypeKind):
(JSC::Wasm::heapTypeKindAsString):
* Source/JavaScriptCore/wasm/WasmParser.h:
(JSC::Wasm::ParserBase::parseBlockSignature):
(JSC::Wasm::ParserBase::parseHeapType):
(JSC::Wasm::ParserBase::parseValueType):

Canonical link: https://commits.webkit.org/280743@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications