loader: add type index checking

Author: kylo5aby

core/iwasm/aot/aot_loader.c

@@ -1730,6 +1730,10 @@ load_types(const uint8 **p_buf, const uint8 *buf_end, AOTModule *module,
             (void)u8;
 
             read_uint32(buf, buf_end, j);
+            if (j >= module->type_count) {
+                set_error_buf(error_buf, error_buf_size, "invalid type index");
+                goto fail;
+            }
             if (module->types[j]->ref_count == UINT16_MAX) {
                 set_error_buf(error_buf, error_buf_size,
                               "wasm type's ref count too large");
@@ -1993,6 +1997,11 @@ load_types(const uint8 **p_buf, const uint8 *buf_end, AOTModule *module,
                 AOTType *cur_type = module->types[j];
                 parent_type_idx = cur_type->parent_type_idx;
                 if (parent_type_idx != (uint32)-1) { /* has parent */
+                    if (parent_type_idx >= module->type_count) {
+                        set_error_buf(error_buf, error_buf_size,
+                                      "invalid parent type index");
+                        goto fail;
+                    }
                     AOTType *parent_type = module->types[parent_type_idx];
 
                     module->types[j]->parent_type = parent_type;
@@ -2015,6 +2024,11 @@ load_types(const uint8 **p_buf, const uint8 *buf_end, AOTModule *module,
             for (j = i - rec_idx; j <= i; j++) {
                 AOTType *cur_type = module->types[j];
                 parent_type_idx = cur_type->parent_type_idx;
+                if (parent_type_idx >= module->type_count) {
+                    set_error_buf(error_buf, error_buf_size,
+                                  "invalid parent type index");
+                    goto fail;
+                }
                 if (parent_type_idx != (uint32)-1) { /* has parent */
                     AOTType *parent_type = module->types[parent_type_idx];
                     /* subtyping has been checked during compilation */