Fix out-of-bounds write in MakeTypeBindingReverseMapping (#2796)

ASan, release build, `wasm2wat` on a crafted module:

    ==…==ERROR: AddressSanitizer: heap-buffer-overflow
      #0 wabt::MakeTypeBindingReverseMapping(...) ir.cc
      #1 wabt::ApplyNames(wabt::Module*)
      #2 ProgramMain
    ... located 1535 bytes after 24-byte region

Found while going over the name-section handlers. The local subsection
stores a (local index, name) pair per entry. `OnLocalNameLocalCount`
checks the entry count against the function's param+local count, but the
per-entry local index in `OnLocalName` is never range-checked before it
becomes a `Binding`. `MakeTypeBindingReverseMapping` sizes the reverse
map to that local count and writes each name at `binding.index`, guarded
only by an `assert`. A name whose index sits past the function's locals
writes off the end of the vector: a debug build trips the assert, a
release build corrupts the heap. Reached from an untrusted `.wasm`
through `wasm2wat` and `wasm2c` (both call `ApplyNames` and read debug
names by default), on an otherwise valid module.

Skip entries that land outside the mapping. Valid modules only name real
locals, so their output does not change. The added test names local
index 5 of a one-param function; before the fix `wasm2wat` aborts, after
it prints the module with the stray name dropped.

Author: aizu-m

src/ir.cc

@@ -605,8 +605,13 @@ void MakeTypeBindingReverseMapping(
   out_reverse_mapping->clear();
   out_reverse_mapping->resize(num_types);
   for (const auto& [name, binding] : bindings) {
-    assert(static_cast<size_t>(binding.index) < out_reverse_mapping->size());
-    (*out_reverse_mapping)[binding.index] = name;
+    // A binding index can come straight from the name section's local
+    // subsection, which is not otherwise range-checked against the function's
+    // local count, so skip entries that fall outside the mapping instead of
+    // writing past it.
+    if (static_cast<size_t>(binding.index) < out_reverse_mapping->size()) {
+      (*out_reverse_mapping)[binding.index] = name;
+    }
   }
 }
 

test/binary/bad-name-section-local-index.txt

@@ -0,0 +1,34 @@
+;;; TOOL: run-gen-wasm
+;; The name section's local subsection can carry a local index that is out of
+;; range for the function it names. The reader accepts such an entry, so
+;; MakeTypeBindingReverseMapping used to write past the reverse-mapping vector
+;; (heap overflow in a release build, assert in a debug build). The out of range
+;; name is now dropped and wasm2wat prints the module unchanged.
+magic
+version
+section(TYPE) {
+  count[1]
+  function params[1] i32 results[0]
+}
+section(FUNCTION) {
+  count[1]
+  type[0]
+}
+section(CODE) {
+  count[1]
+  func { locals[0] }
+}
+section("name") {
+  section(NAME_LOCALS) {
+    func_count[1]
+    index[0]
+    local_count[1]
+    index[5]           ;; function has a single param (index 0), so 5 is invalid
+    str("BAD")
+  }
+}
+(;; STDOUT ;;;
+(module
+  (type (;0;) (func (param i32)))
+  (func (;0;) (type 0) (param i32)))
+;;; STDOUT ;;)