Fix buffer overflow in compilation

Author: tolauwae

src/manage/Compiler.ts

@@ -1,7 +1,7 @@
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import {exec, ExecException} from 'child_process';
+import {exec, ExecException, spawn} from 'child_process';
 import {SourceMap} from '../sourcemap/SourceMap';
 import * as readline from 'readline';
 import {EventEmitter} from 'events';
@@ -94,17 +94,16 @@ export class WatCompiler extends Compiler {
         // compile WAT to Wasm
         return new Promise<CompileOutput>((resolve, reject) => {
             const file = `${dir}/upload.wasm`;
-            const command = `${this.wabt}wat2wasm --no-canonicalize-leb128s --disable-bulk-memory --debug-names -v -o ${file} ${program}`;
+            const command = `${this.wabt}wat2wasm`;
+            const args = ['--no-canonicalize-leb128s', '--disable-bulk-memory', '--debug-names', '-v', '-o', file, program];
             let out: string = '';
             let err: string = '';
 
-            function handle(error: ExecException | null, stdout: string) {
-                out = stdout;
-                err = error?.message ?? '';
-            }
+            const compile = spawn(command, args);
+            this.emit(CompilationEvents.started, `${command} ${args.join(' ')}`);
 
-            const compile = exec(command, handle);
-            this.emit(CompilationEvents.started, command);
+            compile.stdout.on('data', (data) => out += data.toString());
+            compile.stderr.on('data', (data) => err += data.toString());
 
             compile.on('close', (code) => {
                 if (code !== 0) {
@@ -122,24 +121,28 @@ export class WatCompiler extends Compiler {
     public dump(output: CompileOutput): Promise<CompileOutput> {
         // object dump
         return new Promise<CompileOutput>((resolve, reject) => {
-            const command = `${this.wabt}wasm-objdump -x -m ${output.file}`;
+            const executable = `${this.wabt}wasm-objdump`;
+            const args = ['-x', '-m', output.file];
+            let stdout = '';
 
-            const compile = exec(command, (error: ExecException | null, stdout: string) => {
-                output.map = this.parseWasmObjDump(output, stdout.toString());
-                this.emit(CompilationEvents.sourcemap);
-                resolve(output);
-            });
+            const dump = spawn(executable, args);
 
-            compile.on('close', (code) => {
+            dump.stdout.on('data', (data) => stdout += data.toString());
+            dump.on('error', (err) => reject(`wasm-objdump error: ${err.message}`));
+
+            dump.on('close', (code) => {
                 if (code !== 0) {
                     reject(`wasm-objdump exited with code ${code}`);
                     return;
                 }
+                output.map = this.parseWasmObjDump(output, stdout);
+                this.emit(CompilationEvents.sourcemap);
+                resolve(output);
             });
         });
     }
 
-    public async map(program: string): Promise<CompileOutput> {
+    public async map(program: string): Promise<CompileOutput>  {
         return this.compile(program).then((output) => {
             return this.dump(output);
         });

src/sourcemap/SourceMapper.ts

@@ -1,5 +1,5 @@
 import {SourceMap} from './SourceMap';
-import {exec, ExecException} from 'child_process';
+import {spawn} from 'child_process';
 import * as fs from 'fs';
 import {MappingItem, SourceMapConsumer} from 'source-map';
 import SourceLine = SourceMap.SourceLine;
@@ -32,27 +32,36 @@ export class WatMapper implements SourceMapper {
             let functions: Closure[];
             let globals: Variable[];
             let imports: Closure[];
+            let stdout = '';
 
-            function handleObjDumpStreams(error: ExecException | null, stdout: string, stderr: string) {
-                if (stderr.match('wasm-objdump')) {
+            const [executable, ...args] = this.getNameDumpCommand();
+            const objDump = spawn(executable, args);
+
+            objDump.stdout.on('data', (data) => stdout += data.toString());
+
+            objDump.stderr.on('data', (data) => {
+                const text: string = data.toString();
+                if (text.match('wasm-objdump')) {
                     reject('Could not find wasm-objdump in the path');
-                } else if (error) {
-                    reject(error.message);
                 }
+            });
 
+            objDump.on('error', (err) => reject(err.message));
+
+            const sourceMap = new SourceMap.Mapping().init(this.lineMapping, [], [], []);
+            objDump.on('close', (code) => {
+                if (code !== 0) {
+                    reject(`wasm-objdump exited with code ${code}`);
+                    return;
+                }
                 try {
                     functions = WatMapper.getFunctionInfos(stdout);
                     globals = WatMapper.getGlobalInfos(stdout);
                     imports = WatMapper.getImportInfos(stdout);
                 } catch (e) {
                     reject(e);
+                    return;
                 }
-            }
-
-            const objDump = exec(this.getNameDumpCommand(), handleObjDumpStreams);
-
-            const sourceMap = new SourceMap.Mapping().init(this.lineMapping, [], [], []);
-            objDump.on('close', () => {
                 sourceMap.functions = functions;
                 sourceMap.globals = globals;
                 sourceMap.imports = imports;
@@ -137,8 +146,8 @@ export class WatMapper implements SourceMapper {
         return globals;
     }
 
-    private getNameDumpCommand(): string {
-        return `${this.wabt}/wasm-objdump -x -m ${this.tmpdir}/upload.wasm`;
+    private getNameDumpCommand(): string[] {
+        return [`${this.wabt}/wasm-objdump`,  '-x', '-m', `${this.tmpdir}/upload.wasm`];
     }
 }