From 1165e13c256cb4aeb76674c2bc34f35c6ebd375b Mon Sep 17 00:00:00 2001 From: Jonathan Marler Date: Sun, 16 Jun 2024 07:45:30 -0600 Subject: [PATCH] wasm2c: avoid indexing null pointer triggering undefined behavior Using zig cc to compile and run wasm2c on zig.wasm on Windows triggers what appears to be a sanitizer crash. The FuncGen reuse array pointer is initialized to null and at some point it's resized to a length of zero, which triggers this code to execute: memcpy(&self->reuse[self->reuse_i], &self->reuse[reuse_top], sizeof(uint32_t) * reuse_n); Given the current values, this equates to: memcpy(&(NULL)[0], &(NULL)[0], 0); Taking the address of the first element of a null pointer doesn't trigger any actual runtime problem, since the pointer won't be dereferenced because were passing 0 as the length to memcpy, however, it seems that the C spec considers indexing a null pointer to be undefined behavior even if you don't use the resulting value (or are just taking the address of an indexed pointer). --- stage1/FuncGen.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/stage1/FuncGen.h b/stage1/FuncGen.h index 572e17f680..494dd202b2 100644 --- a/stage1/FuncGen.h +++ b/stage1/FuncGen.h @@ -179,8 +179,10 @@ static void FuncGen_blockBegin(struct FuncGen *self, FILE *out, enum WasmOpcode self->reuse = realloc(self->reuse, sizeof(uint32_t) * self->reuse_len); if (self->reuse == NULL) panic("out of memory"); } - memcpy(&self->reuse[self->reuse_i], &self->reuse[reuse_top], sizeof(uint32_t) * reuse_n); - self->reuse_i += reuse_n; + if (reuse_n != 0) { + memcpy(&self->reuse[self->reuse_i], &self->reuse[reuse_top], sizeof(uint32_t) * reuse_n); + self->reuse_i += reuse_n; + } } static enum WasmOpcode FuncGen_blockKind(const struct FuncGen *self, uint32_t label_idx) {