Skip to content

fix(tailcall): Fixes heap buffer overflow in fast interpreter (#4916)#4917

Merged
lum1n0us merged 1 commit intobytecodealliance:mainfrom
srberard:fixes/tailcall-heap-buf
Apr 17, 2026
Merged

fix(tailcall): Fixes heap buffer overflow in fast interpreter (#4916)#4917
lum1n0us merged 1 commit intobytecodealliance:mainfrom
srberard:fixes/tailcall-heap-buf

Conversation

@srberard
Copy link
Copy Markdown
Contributor

Fixes #4916 and adds case to regression tests.

…dealliance#4916)

Signed-off-by: Stephen Berard <stephen.berard@outlook.com>
@srberard srberard requested a review from lum1n0us as a code owner April 16, 2026 10:50
Copilot AI review requested due to automatic review settings April 16, 2026 10:50
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes the heap buffer overflow described in #4916 by adding a missing operand-stack bounds check to the fast-interp return_call (tail call) path, and adds a regression test case + CI build target to exercise tail calls in fast-interp.

Changes:

  • Add operand stack overflow check in call_func_from_return_call before copying staged tail-call parameters.
  • Add a regression test module (tail_call_stack_overflow.wat/.wasm) reproducing the const-pool-size mismatch scenario.
  • Extend BA regression harness configuration and build script with a tail-call-enabled fast-interp runtime.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
core/iwasm/interpreter/wasm_interp_fast.c Adds missing bounds check in fast-interp tail-call parameter staging to prevent out-of-bounds writes.
tests/regression/ba-issues/running_config.json Registers new regression case for issue #4916 using a tail-call-enabled runtime.
tests/regression/ba-issues/issues/issue-4916/tail_call_stack_overflow.wat Adds readable source test that inflates callee const pool and tail-calls from a tiny caller.
tests/regression/ba-issues/issues/issue-4916/tail_call_stack_overflow.wasm Adds compiled wasm artifact used by the regression harness.
tests/regression/ba-issues/build_wamr.sh Builds an additional iwasm variant with fast-interp + tail-call enabled (WASI disabled).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread core/iwasm/interpreter/wasm_interp_fast.c
@lum1n0us lum1n0us merged commit 4b306f0 into bytecodealliance:main Apr 17, 2026
579 of 586 checks passed
kylo5aby pushed a commit to kylo5aby/wasm-micro-runtime that referenced this pull request Apr 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] Heap buffer overflow in fast interpreter tail call path

3 participants