diff options
| author | Cherry Mui <cherryyz@google.com> | 2021-09-02 16:51:59 -0400 |
|---|---|---|
| committer | Michael Knyszek <mknyszek@google.com> | 2021-10-07 18:45:53 +0000 |
| commit | 77f2750f4398990eed972186706f160631d7dae4 (patch) | |
| tree | 7a1091cde70530c889b72ad8bd471de1fcc0853f /misc/wasm | |
| parent | 2043b3b47b3ca76d8ce44f05a77e48d2291b6fc6 (diff) | |
| download | go-77f2750f4398990eed972186706f160631d7dae4.tar.gz go-77f2750f4398990eed972186706f160631d7dae4.zip | |
misc/wasm, cmd/link: do not let command line args overwrite global data
On Wasm, wasm_exec.js puts command line arguments at the beginning
of the linear memory (following the "zero page"). Currently there
is no limit for this, and a very long command line can overwrite
the program's data section. Prevent this by limiting the command
line to 4096 bytes, and in the linker ensuring the data section
starts at a high enough address (8192).
(Arguably our address assignment on Wasm is a bit confusing. This
is the minimum fix I can come up with.)
Thanks to Ben Lubar for reporting this issue.
Fixes #48797
Fixes CVE-2021-38297
Change-Id: I0f50fbb2a5b6d0d047e3c134a88988d9133e4ab3
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1205933
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Than McIntosh <thanm@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/354571
Reviewed-by: Cherry Mui <cherryyz@google.com>
Reviewed-by: Heschi Kreinick <heschi@google.com>
Trust: Michael Knyszek <mknyszek@google.com>
Run-TryBot: Michael Knyszek <mknyszek@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Diffstat (limited to 'misc/wasm')
| -rw-r--r-- | misc/wasm/wasm_exec.js | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/misc/wasm/wasm_exec.js b/misc/wasm/wasm_exec.js index 22b19fbe80..e2f3cda995 100644 --- a/misc/wasm/wasm_exec.js +++ b/misc/wasm/wasm_exec.js @@ -568,6 +568,13 @@ offset += 8; }); + // The linker guarantees global data starts from at least wasmMinDataAddr. + // Keep in sync with cmd/link/internal/ld/data.go:wasmMinDataAddr. + const wasmMinDataAddr = 4096 + 4096; + if (offset >= wasmMinDataAddr) { + throw new Error("command line too long"); + } + this._inst.exports.run(argc, argv); if (this.exited) { this._resolveExitPromise(); |