Skip to content

Commit 9e4aa9c

Browse files
lum1n0uslum1n0us
authored
fuzzing: reject non-wasm files quickly and execute aot after compilation (#4780)
* fix: disable unsigned integer overflow sanitization in build configurations FYI: from https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html `-fsanitize=unsigned-integer-overflow`: Unsigned integer overflow, where the result of an unsigned integer computation cannot be represented in its type. Unlike signed integer overflow, this is not undefined behavior, but it is often unintentional. This sanitizer does not check for lossy implicit conversions performed before such a computation. It brings a more common question: which is better, pre-additional-check or post-additional-check to fix a potential unsigned integer overflow? A pre-additional-check involves using a check to prevent integer overflow from the very beginning. A post-additional-check involves using a check after addition to see if there is an overflow. In this project, post-additional-checking is widely used. let's follow the routine. for performance sensitive logic, use __builtin_add_overflow etc. provide something like https://github.com/yamt/toywasm/blob/9a5622791e99395e26e6e96cef830af3d91a1685/lib/platform.h#L176-L191 and encourage the use of them. ref. #4549 (comment) * fix: update AOT compiler configuration and enhance error handling in fuzz tests
1 parent 46c341b commit 9e4aa9c

File tree

9 files changed

+298
-198
lines changed

9 files changed

+298
-198
lines changed

‎build-scripts/config_common.cmake‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,8 @@ if (NOT WAMR_BUILD_SANITIZER STREQUAL "")
196196
message(FATAL_ERROR "Unsupported sanitizers: ${INVALID_SANITIZERS}")
197197
endif()
198198
# common flags for all sanitizers
199-
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -g -O0 -fno-omit-frame-pointer -fno-sanitize-recover=all -fno-sanitize=alignment")
199+
# clang: warning: the object size sanitizer has no effect at -O0, but is explicitly enabled ... [-Winvalid-command-line-argument]
200+
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -g -O1 -fno-omit-frame-pointer -fno-sanitize-recover=all -fno-sanitize=alignment")
200201
if(CMAKE_C_COMPILER_ID MATCHES ".*Clang")
201202
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fno-sanitize=unsigned-integer-overflow")
202203
endif()

‎core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/src/posix.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -430,7 +430,7 @@ fd_table_attach(struct fd_table *ft, __wasi_fd_t fd, struct fd_object *fo,
430430
__wasi_rights_t rights_base, __wasi_rights_t rights_inheriting)
431431
REQUIRES_EXCLUSIVE(ft->lock) CONSUMES(fo->refcount)
432432
{
433-
bh_assert(ft->size > fd && "File descriptor table too small");
433+
bh_assert(ft->size > (size_t)fd && "File descriptor table too small");
434434
struct fd_entry *fe = &ft->entries[fd];
435435
bh_assert(fe->object == NULL
436436
&& "Attempted to overwrite an existing descriptor");

‎tests/fuzz/wasm-mutator-fuzz/aot-compiler/CMakeLists.txt‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,6 @@
11
# Copyright (C) 2025 Intel Corporation. All rights reserved.
22
# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
33

4-
# Set default build options with the ability to override from the command line
5-
if(NOT WAMR_BUILD_INTERP)
6-
set(WAMR_BUILD_INTERP 1)
7-
endif()
8-
9-
set(WAMR_BUILD_WAMR_COMPILER 1)
104
set(WAMR_BUILD_AOT 0)
115
set(WAMR_BUILD_INTERP 1)
126
set(WAMR_BUILD_JIT 0)
@@ -67,5 +61,6 @@ target_link_directories(aotclib PUBLIC ${LLVM_LIBRARY_DIR})
6761

6862
target_link_libraries(aotclib PUBLIC ${REQUIRED_LLVM_LIBS})
6963

70-
add_executable(aot_compiler_fuzz aot_compiler_fuzz.cc)
64+
add_executable(aot_compiler_fuzz aot_compiler_fuzz.cc ../common/fuzzer_common.cc)
65+
target_include_directories(aot_compiler_fuzz PRIVATE ../common)
7166
target_link_libraries(aot_compiler_fuzz PRIVATE stdc++ aotclib)

‎tests/fuzz/wasm-mutator-fuzz/aot-compiler/aot_compiler_fuzz.cc‎

Lines changed: 44 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
#include "aot_export.h"
1212
#include "wasm_export.h"
1313
#include "bh_read_file.h"
14+
#include "../common/fuzzer_common.h"
1415

1516
static void
1617
handle_aot_recent_error(const char *tag)
@@ -26,32 +27,39 @@ handle_aot_recent_error(const char *tag)
2627
extern "C" int
2728
LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
2829
{
30+
char kTargetArch[] = "x86_64";
31+
char kTargetAbi[] = "gnu";
2932
wasm_module_t module = NULL;
30-
char error_buf[128] = { 0 };
33+
char error_buf[ERROR_BUF_SIZE] = { 0 };
3134
AOTCompOption option = { 0 };
3235
aot_comp_data_t comp_data = NULL;
3336
aot_comp_context_t comp_ctx = NULL;
37+
uint8 *aot_file_buf = NULL;
38+
uint32 aot_file_size = 0;
39+
wasm_module_t aot_module = NULL;
40+
wasm_module_inst_t inst = NULL;
3441

35-
/* libfuzzer don't allow to modify the given Data, so make a copy here */
36-
std::vector<uint8_t> myData(Data, Data + Size);
37-
42+
/* libfuzzer don't allow to modify the given Data, but get_package_type and
43+
* wasm_runtime_load only read the data, so we can safely use const_cast */
3844
if (Size >= 4
39-
&& get_package_type(myData.data(), Size) != Wasm_Module_Bytecode) {
45+
&& get_package_type(const_cast<uint8_t *>(Data), Size)
46+
!= Wasm_Module_Bytecode) {
4047
printf("Invalid wasm file: magic header not detected\n");
4148
return 0;
4249
}
4350

4451
wasm_runtime_init();
4552

46-
module = wasm_runtime_load((uint8_t *)myData.data(), Size, error_buf, 120);
53+
module = wasm_runtime_load(const_cast<uint8_t *>(Data), Size, error_buf,
54+
MAX_ERROR_BUF_SIZE);
4755
if (!module) {
4856
std::cout << "[LOADING] " << error_buf << std::endl;
4957
goto DESTROY_RUNTIME;
5058
}
5159

5260
// TODO: target_arch and other fields
53-
option.target_arch = "x86_64";
54-
option.target_abi = "gnu";
61+
option.target_arch = kTargetArch;
62+
option.target_abi = kTargetAbi;
5563
option.enable_bulk_memory = true;
5664
option.enable_thread_mgr = true;
5765
option.enable_tail_call = true;
@@ -78,6 +86,34 @@ LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
7886
goto DESTROY_COMP_CTX;
7987
}
8088

89+
aot_file_buf = aot_emit_aot_file_buf(comp_ctx, comp_data, &aot_file_size);
90+
if (!aot_file_buf) {
91+
handle_aot_recent_error("[EMITTING AOT FILE]");
92+
goto DESTROY_COMP_CTX;
93+
}
94+
95+
aot_module = wasm_runtime_load(aot_file_buf, aot_file_size, error_buf,
96+
ERROR_BUF_SIZE);
97+
if (!aot_module) {
98+
std::cout << "[LOADING AOT MODULE] " << error_buf << std::endl;
99+
goto RELEASE_AOT_FILE_BUF;
100+
}
101+
102+
inst = wasm_runtime_instantiate(aot_module, 1024 * 8, 0, error_buf,
103+
ERROR_BUF_SIZE);
104+
if (!inst) {
105+
std::cout << "[INSTANTIATING AOT MODULE] " << error_buf << std::endl;
106+
goto UNLOAD_AOT_MODULE;
107+
}
108+
109+
execute_export_functions(module, inst);
110+
111+
DEINSTANTIZE_AOT_MODULE:
112+
wasm_runtime_deinstantiate(inst);
113+
UNLOAD_AOT_MODULE:
114+
wasm_runtime_unload(aot_module);
115+
RELEASE_AOT_FILE_BUF:
116+
wasm_runtime_free(aot_file_buf);
81117
DESTROY_COMP_CTX:
82118
aot_destroy_comp_context(comp_ctx);
83119
DESTROY_COMP_DATA:

‎tests/fuzz/wasm-mutator-fuzz/common/fuzzer_common.cc‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
// Copyright (C) 2025 Intel Corporation. All rights reserved.
2+
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
3+
4+
#include "fuzzer_common.h"
5+
#include <iostream>
6+
#include <string.h>
7+
8+
void
9+
print_execution_args(const wasm_export_t &export_type,
10+
const std::vector<wasm_val_t> &args, unsigned param_count)
11+
{
12+
std::cout << "[EXECUTION] " << export_type.name << "(";
13+
for (unsigned p_i = 0; p_i < param_count; p_i++) {
14+
if (p_i != 0) {
15+
std::cout << ", ";
16+
}
17+
18+
switch (args[p_i].kind) {
19+
case WASM_I32:
20+
std::cout << "i32:" << args[p_i].of.i32;
21+
break;
22+
case WASM_I64:
23+
std::cout << "i64:" << args[p_i].of.i64;
24+
break;
25+
case WASM_F32:
26+
std::cout << "f32:" << args[p_i].of.f32;
27+
break;
28+
case WASM_F64:
29+
std::cout << "f64:" << args[p_i].of.f64;
30+
break;
31+
case WASM_EXTERNREF:
32+
std::cout << "externref:" << args[p_i].of.foreign;
33+
break;
34+
default:
35+
// because aft is_supported_val_kind() check, so we can safely
36+
// return as WASM_FUNCREF
37+
std::cout << "funcref:" << args[p_i].of.ref;
38+
break;
39+
}
40+
}
41+
std::cout << ")" << std::endl;
42+
}
43+
44+
bool
45+
execute_export_functions(wasm_module_t module, wasm_module_inst_t inst)
46+
{
47+
int32_t export_count = wasm_runtime_get_export_count(module);
48+
49+
for (int e_i = 0; e_i < export_count; e_i++) {
50+
wasm_export_t export_type;
51+
52+
memset(&export_type, 0, sizeof(export_type));
53+
wasm_runtime_get_export_type(module, e_i, &export_type);
54+
55+
if (export_type.kind != WASM_IMPORT_EXPORT_KIND_FUNC) {
56+
continue;
57+
}
58+
59+
wasm_function_inst_t func =
60+
wasm_runtime_lookup_function(inst, export_type.name);
61+
if (!func) {
62+
std::cout << "Failed to lookup function: " << export_type.name
63+
<< std::endl;
64+
continue;
65+
}
66+
67+
wasm_func_type_t func_type = export_type.u.func_type;
68+
uint32_t param_count = wasm_func_type_get_param_count(func_type);
69+
70+
/* build arguments with capacity reservation */
71+
std::vector<wasm_val_t> args;
72+
args.reserve(param_count); // Optimization: prevent reallocations
73+
for (unsigned p_i = 0; p_i < param_count; p_i++) {
74+
wasm_valkind_t param_type =
75+
wasm_func_type_get_param_valkind(func_type, p_i);
76+
77+
if (!is_supported_val_kind(param_type)) {
78+
std::cout
79+
<< "Bypass execution because of unsupported value kind: "
80+
<< param_type << std::endl;
81+
return true;
82+
}
83+
84+
wasm_val_t arg = pre_defined_val(param_type);
85+
args.push_back(arg);
86+
}
87+
88+
/* build results storage */
89+
uint32_t result_count = wasm_func_type_get_result_count(func_type);
90+
std::vector<wasm_val_t> results(
91+
result_count); // Optimization: direct initialization
92+
93+
print_execution_args(export_type, args, param_count);
94+
95+
/* execute the function */
96+
wasm_exec_env_t exec_env = wasm_runtime_get_exec_env_singleton(inst);
97+
if (!exec_env) {
98+
std::cout << "Failed to get exec env" << std::endl;
99+
return false;
100+
}
101+
102+
bool ret =
103+
wasm_runtime_call_wasm_a(exec_env, func, result_count,
104+
results.data(), param_count, args.data());
105+
if (!ret) {
106+
const char *exception = wasm_runtime_get_exception(inst);
107+
if (!exception) {
108+
std::cout << "[EXECUTION] " << export_type.name
109+
<< "() failed. No exception info." << std::endl;
110+
}
111+
else {
112+
std::cout << "[EXECUTION] " << export_type.name << "() failed. "
113+
<< exception << std::endl;
114+
}
115+
}
116+
117+
wasm_runtime_clear_exception(inst);
118+
}
119+
120+
return true;
121+
}
122+
123+
void
124+
report_fuzzer_error(FuzzerErrorPhase phase, const char *message)
125+
{
126+
const char *phase_name = "";
127+
switch (phase) {
128+
case FuzzerErrorPhase::LOADING:
129+
phase_name = "LOADING";
130+
break;
131+
case FuzzerErrorPhase::INSTANTIATING:
132+
phase_name = "INSTANTIATING";
133+
break;
134+
case FuzzerErrorPhase::COMPILING:
135+
phase_name = "COMPILING";
136+
break;
137+
case FuzzerErrorPhase::EXECUTION:
138+
phase_name = "EXECUTION";
139+
break;
140+
case FuzzerErrorPhase::CLEANUP:
141+
phase_name = "CLEANUP";
142+
break;
143+
}
144+
std::cout << "[" << phase_name << "] " << message << std::endl;
145+
}

‎tests/fuzz/wasm-mutator-fuzz/common/fuzzer_common.h‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
// Copyright (C) 2025 Intel Corporation. All rights reserved.
2+
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
3+
4+
#ifndef FUZZER_COMMON_H
5+
#define FUZZER_COMMON_H
6+
7+
#include "wasm_export.h"
8+
#include <iostream>
9+
#include <vector>
10+
11+
// Constants for consistent buffer sizes
12+
constexpr size_t ERROR_BUF_SIZE = 128;
13+
constexpr size_t MAX_ERROR_BUF_SIZE = 120; // Used in wasm_runtime_load
14+
15+
// Error phases for consistent reporting
16+
enum class FuzzerErrorPhase {
17+
LOADING,
18+
INSTANTIATING,
19+
COMPILING,
20+
EXECUTION,
21+
CLEANUP
22+
};
23+
24+
// Small inline helper functions
25+
26+
// Check if a value kind is supported by the fuzzer
27+
static inline bool
28+
is_supported_val_kind(wasm_valkind_t kind)
29+
{
30+
return kind == WASM_I32 || kind == WASM_I64 || kind == WASM_F32
31+
|| kind == WASM_F64 || kind == WASM_EXTERNREF
32+
|| kind == WASM_FUNCREF;
33+
}
34+
35+
// Generate a predefined value for a given value kind
36+
static inline wasm_val_t
37+
pre_defined_val(wasm_valkind_t kind)
38+
{
39+
if (kind == WASM_I32) {
40+
return wasm_val_t{ .kind = WASM_I32, .of = { .i32 = 2025 } };
41+
}
42+
else if (kind == WASM_I64) {
43+
return wasm_val_t{ .kind = WASM_I64, .of = { .i64 = 168 } };
44+
}
45+
else if (kind == WASM_F32) {
46+
return wasm_val_t{ .kind = WASM_F32, .of = { .f32 = 3.14159f } };
47+
}
48+
else if (kind == WASM_F64) {
49+
return wasm_val_t{ .kind = WASM_F64, .of = { .f64 = 2.71828 } };
50+
}
51+
else if (kind == WASM_EXTERNREF) {
52+
return wasm_val_t{ .kind = WASM_EXTERNREF,
53+
.of = { .foreign = 0xabcddead } };
54+
}
55+
// because aft is_supported_val_kind() check, so we can safely return as
56+
// WASM_FUNCREF
57+
else {
58+
return wasm_val_t{ .kind = WASM_FUNCREF, .of = { .ref = nullptr } };
59+
}
60+
}
61+
62+
// Function declarations (implemented in fuzzer_common.cc)
63+
64+
// Print execution arguments for debugging
65+
void
66+
print_execution_args(const wasm_export_t &export_type,
67+
const std::vector<wasm_val_t> &args, unsigned param_count);
68+
69+
// Execute all export functions in a module
70+
bool
71+
execute_export_functions(wasm_module_t module, wasm_module_inst_t inst);
72+
73+
// Helper for consistent error reporting
74+
void
75+
report_fuzzer_error(FuzzerErrorPhase phase, const char *message);
76+
77+
#endif // FUZZER_COMMON_H

‎tests/fuzz/wasm-mutator-fuzz/sanitizer_flags.cmake‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ if(NOT IN_OSS_FUZZ)
1212

1313
# SANITIZER_FLAGS_undefined
1414
add_compile_options(
15+
-O1
1516
-fsanitize=array-bounds,bool,builtin,enum,function,integer-divide-by-zero,null,object-size,return,returns-nonnull-attribute,shift,signed-integer-overflow,unsigned-integer-overflow,unreachable,vla-bound,vptr
1617
-fno-sanitize-recover=array-bounds,bool,builtin,enum,function,integer-divide-by-zero,null,object-size,return,returns-nonnull-attribute,shift,signed-integer-overflow,unreachable,vla-bound,vptr
1718
)

‎tests/fuzz/wasm-mutator-fuzz/wasm-mutator/CMakeLists.txt‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,8 @@ if(NOT DEFINED WAMR_BUILD_SIMD)
4747
endif()
4848

4949
set(WAMR_BUILD_REF_TYPES 1)
50-
set(WAMR_BUILD_GC 1)
50+
# disable it since it is not fully supported
51+
set(WAMR_BUILD_GC 0)
5152

5253
include(${REPO_ROOT_DIR}/build-scripts/runtime_lib.cmake)
5354
include(${REPO_ROOT_DIR}/core/shared/utils/uncommon/shared_uncommon.cmake)
@@ -57,5 +58,6 @@ target_include_directories(vmlib PUBLIC ${RUNTIME_LIB_HEADER_LIST})
5758
target_link_directories(vmlib PUBLIC ${RUNTIME_LIB_LINK_LIST})
5859
target_link_libraries(vmlib PUBLIC ${REQUIRED_LLVM_LIBS})
5960

60-
add_executable(wasm_mutator_fuzz wasm_mutator_fuzz.cc)
61+
add_executable(wasm_mutator_fuzz wasm_mutator_fuzz.cc ../common/fuzzer_common.cc)
62+
target_include_directories(wasm_mutator_fuzz PRIVATE ../common)
6163
target_link_libraries(wasm_mutator_fuzz PRIVATE vmlib m)

0 commit comments

Comments
 (0)