loader: fix a potential overflow issue (#4427)

kylo5aby · web-flow · commit 0127eafbe562 · 2025-06-30T12:57:57.000+08:00
diff --git a/core/iwasm/interpreter/wasm_loader.c b/core/iwasm/interpreter/wasm_loader.c
@@ -2042,16 +2042,17 @@ load_type_section(const uint8 *buf, const uint8 *buf_end, WASMModule *module,
                                       "recursive type count too large");
                         return false;
                     }
-                    module->type_count += rec_count - 1;
                     new_total_size =
-                        sizeof(WASMFuncType *) * (uint64)module->type_count;
+                        sizeof(WASMFuncType *)
+                        * (uint64)(module->type_count + rec_count - 1);
                     if (new_total_size > UINT32_MAX) {
                         set_error_buf(error_buf, error_buf_size,
                                       "allocate memory failed");
                         return false;
                     }
                     MEM_REALLOC(module->types, (uint32)total_size,
                                 (uint32)new_total_size);
+                    module->type_count += rec_count - 1;
                     total_size = new_total_size;
                 }
 

Original file line number	Diff line number	Diff line change
`@@ -2042,16 +2042,17 @@ load_type_section(const uint8 buf, const uint8 buf_end, WASMModule *module,`
`2042`	`2042`	`"recursive type count too large");`
`2043`	`2043`	`return false;`
`2044`	`2044`	`}`
`2045`		`- module->type_count += rec_count - 1;`
`2046`	`2045`	`new_total_size =`
`2047`		`- sizeof(WASMFuncType ) (uint64)module->type_count;`
	`2046`	`+ sizeof(WASMFuncType *)`
	`2047`	`+ * (uint64)(module->type_count + rec_count - 1);`
`2048`	`2048`	`if (new_total_size > UINT32_MAX) {`
`2049`	`2049`	`set_error_buf(error_buf, error_buf_size,`
`2050`	`2050`	`"allocate memory failed");`
`2051`	`2051`	`return false;`
`2052`	`2052`	`}`
`2053`	`2053`	`MEM_REALLOC(module->types, (uint32)total_size,`
`2054`	`2054`	`(uint32)new_total_size);`
	`2055`	`+ module->type_count += rec_count - 1;`
`2055`	`2056`	`total_size = new_total_size;`
`2056`	`2057`	`}`
`2057`	`2058`