Skip to content

[Strings] Limit string allocations like we do arrays #6562

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kripken merged 1 commit into from
Apr 29, 2024
Merged

[Strings] Limit string allocations like we do arrays #6562

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
[Strings] Limit string allocations like we do arrays
  • Loading branch information
@kripken
kripken committed Apr 29, 2024
commit a69ef01aededc92090c3c6e4773b74cd0d6eb8d2
11 changes: 8 additions & 3 deletions src/wasm-interpreter.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1620,7 +1620,7 @@ class ExpressionRunner : public OverriddenVisitor<SubType, Flow> {
// vector that takes around 1-2GB of memory then we are likely to hit memory
// limits on 32-bit machines, and in particular on wasm32 VMs that do not
// have 4GB support, so give up there.
static const Index ArrayLimit = (1 << 30) / sizeof(Literal);
static const Index DataLimit = (1 << 30) / sizeof(Literal);

Flow visitArrayNew(ArrayNew* curr) {
NOTE_ENTER("ArrayNew");
Expand All @@ -1645,7 +1645,7 @@ class ExpressionRunner : public OverriddenVisitor<SubType, Flow> {
auto heapType = curr->type.getHeapType();
const auto& element = heapType.getArray().element;
Index num = size.getSingleValue().geti32();
if (num >= ArrayLimit) {
if (num >= DataLimit) {
hostLimit("allocation failure");
}
Literals data(num);
Expand All @@ -1668,7 +1668,7 @@ class ExpressionRunner : public OverriddenVisitor<SubType, Flow> {
Flow visitArrayNewFixed(ArrayNewFixed* curr) {
NOTE_ENTER("ArrayNewFixed");
Index num = curr->values.size();
if (num >= ArrayLimit) {
if (num >= DataLimit) {
hostLimit("allocation failure");
}
if (curr->type == Type::unreachable) {
Expand Down Expand Up @@ -1953,6 +1953,11 @@ class ExpressionRunner : public OverriddenVisitor<SubType, Flow> {
trap("null ref");
}

auto totalSize = leftData->values.size() + rightData->values.size();
if (totalSize >= DataLimit) {
hostLimit("allocation failure");
}

Literals contents;
contents.reserve(leftData->values.size() + rightData->values.size());
for (Literal& l : leftData->values) {
Expand Down