wasmparser: reject bare type index as a value type

The short form of a reference type (without a `0x63`/`0x64` prefix) is only an
abbreviation for `ref null <abstract-heap-type>`. The decoder instead read a
full heap type there, so a bare non-negative type index was accepted as a
value type, e.g. `0x00` decoding to `(ref null 0)`.

Reject concrete/exact heap types reached through the short-form path with
`malformed reference type` at decode time, matching the reference interpreter.
This also covers the over-long-LEB variant (`ff 00`). The legitimate
`0x63 <idx>` / `0x64 <idx>` concrete reftypes and the `shared` abstract
shorthands (`0x65 ...`) are unaffected.

Author: vouillon

crates/wasmparser/src/readers/core/types.rs

@@ -1831,6 +1831,15 @@ impl<'a> FromReader<'a> for RefType {
                     }
                     e
                 })?;
+                // The short form of a reference type (without a `0x63`/`0x64`
+                // prefix byte) is only an abbreviation for `ref null <ht>` where
+                // `<ht>` is an *abstract* heap type. A bare (non-negative) type
+                // index is not a value type, so reject concrete/exact heap types
+                // reached through this path even though they parse as heap types
+                // in their own right.
+                if let HeapType::Concrete(_) | HeapType::Exact(_) = hty {
+                    return Err(crate::Error::new("malformed reference type", pos));
+                }
                 RefType::new(true, hty)
                     .ok_or_else(|| crate::Error::new("type index too large", pos))
             }

tests/cli/bad-reftype.wast

@@ -0,0 +1,26 @@
+;; RUN: wast --assert default --snapshot tests/snapshots %
+
+;; A value type is `numtype | vectype | reftype`, and a reference type is either
+;; an abstract heap type shorthand byte or the two-byte `0x64 heaptype` (`ref ht`)
+;; / `0x63 heaptype` (`ref null ht`) forms. There is no bare type-index value
+;; type, so a leading byte of `0x00` (a non-negative sLEB) is malformed.
+
+;; type 0 = (func), type 1 = (func (param <0x00>)) — bare index used as a value type.
+(assert_malformed
+  (module binary
+    "\00asm\01\00\00\00\01\08\02\60\00\00\60\01\00\00")
+  "malformed reference type")
+
+;; The same bug with an over-long LEB encoding of the bare index (`\ff\00` = 127).
+;; The reftype discriminator is a single byte, so this must be rejected at decode
+;; time rather than re-interpreted as a type index.
+(assert_malformed
+  (module binary
+    "\00asm\01\00\00\00\01\09\02\60\00\00\60\01\ff\00\00")
+  "malformed reference type")
+
+;; Boundary: the legitimate concrete reftypes `0x63 <idx>` (`ref null $t`) and
+;; `0x64 <idx>` (`ref $t`), where the index is an sLEB after the prefix byte, must
+;; still be accepted.
+(module binary
+  "\00asm\01\00\00\00\01\0b\02\60\00\00\60\02\63\00\64\00\00")

tests/snapshots/cli/bad-reftype.wast.json

@@ -0,0 +1,25 @@
+{
+  "source_filename": "tests/cli/bad-reftype.wast",
+  "commands": [
+    {
+      "type": "assert_malformed",
+      "line": 10,
+      "filename": "bad-reftype.0.wasm",
+      "module_type": "binary",
+      "text": "malformed reference type"
+    },
+    {
+      "type": "assert_malformed",
+      "line": 18,
+      "filename": "bad-reftype.1.wasm",
+      "module_type": "binary",
+      "text": "malformed reference type"
+    },
+    {
+      "type": "module",
+      "line": 25,
+      "filename": "bad-reftype.2.wasm",
+      "module_type": "binary"
+    }
+  ]
+}

tests/snapshots/cli/bad-reftype.wast/2.print

@@ -0,0 +1,4 @@
+(module
+  (type (;0;) (func))
+  (type (;1;) (func (param (ref null 0) (ref 0))))
+)