Fix passive element reader (bytecodealliance#150)

Author: yurydelendik

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "wasmparser"
-version = "0.42.1"
+version = "0.43.0"
 authors = ["Yury Delendik <ydelendik@mozilla.com>"]
 license = "Apache-2.0 WITH LLVM-exception"
 repository = "https://github.com/yurydelendik/wasmparser.rs"

src/lib.rs

@@ -111,6 +111,7 @@ pub use crate::readers::NamingReader;
 pub use crate::readers::OperatorsReader;
 pub use crate::readers::PassiveElementItem;
 pub use crate::readers::PassiveElementItems;
+pub use crate::readers::PassiveElementItemsReader;
 pub use crate::readers::ProducersField;
 pub use crate::readers::ProducersFieldValue;
 pub use crate::readers::ProducersSectionReader;

src/parser.rs

@@ -31,8 +31,9 @@ use crate::readers::{
     ActiveElementItems, CodeSectionReader, Data, DataKind, DataSectionReader, Element, ElementKind,
     ElementSectionReader, Export, ExportSectionReader, FunctionBody, FunctionSectionReader, Global,
     GlobalSectionReader, Import, ImportSectionReader, LinkingSectionReader, MemorySectionReader,
-    ModuleReader, Name, NameSectionReader, NamingReader, OperatorsReader, PassiveElementItems,
-    Reloc, RelocSectionReader, Section, SectionReader, TableSectionReader, TypeSectionReader,
+    ModuleReader, Name, NameSectionReader, NamingReader, OperatorsReader, PassiveElementItem,
+    PassiveElementItems, Reloc, RelocSectionReader, Section, SectionReader, TableSectionReader,
+    TypeSectionReader,
 };
 
 use crate::binary_reader::{BinaryReader, Range};
@@ -116,9 +117,12 @@ pub enum ParserState<'a> {
     EndFunctionBody,
     SkippingFunctionBody,
 
-    BeginPassiveElementSectionEntry(Type),
     BeginActiveElementSectionEntry(u32),
     ElementSectionEntryBody(Box<[u32]>),
+    PassiveElementSectionEntry {
+        ty: Type,
+        items: Box<[PassiveElementItem]>,
+    },
     EndElementSectionEntry,
 
     BeginPassiveDataSectionEntry,
@@ -204,7 +208,6 @@ pub struct Parser<'a> {
     module_reader: Option<ModuleReader<'a>>,
     current_section: Option<Section<'a>>,
     section_reader: ParserSectionReader<'a>,
-    passive_element_items: Option<PassiveElementItems<'a>>,
     active_element_items: Option<ActiveElementItems<'a>>,
     current_function_body: Option<FunctionBody<'a>>,
     init_expr_continuation: Option<InitExpressionContinuationSection>,
@@ -232,7 +235,6 @@ impl<'a> Parser<'a> {
             current_section: None,
             section_reader: ParserSectionReader::None,
             active_element_items: None,
-            passive_element_items: None,
             current_function_body: None,
             init_expr_continuation: None,
             current_data_segment: None,
@@ -424,8 +426,10 @@ impl<'a> Parser<'a> {
         let Element { kind } = section_reader!(self, ElementSectionReader).read()?;
         match kind {
             ElementKind::Passive { ty, items } => {
-                self.state = ParserState::BeginPassiveElementSectionEntry(ty);
-                self.passive_element_items = Some(items);
+                self.state = ParserState::PassiveElementSectionEntry {
+                    ty,
+                    items: self.read_passive_elements(items)?,
+                };
             }
             ElementKind::Active {
                 table_index,
@@ -462,6 +466,22 @@ impl<'a> Parser<'a> {
         Ok(())
     }
 
+    fn read_passive_elements(
+        &mut self,
+        items: PassiveElementItems,
+    ) -> Result<Box<[PassiveElementItem]>> {
+        let reader = items.get_items_reader()?;
+        let num_elements = reader.get_count() as usize;
+        if num_elements > MAX_WASM_TABLE_ENTRIES {
+            return Err(BinaryReaderError {
+                message: "num_elements is out of bounds",
+                offset: 0, // reader.position - 1, // TODO offset
+            });
+        }
+        let elements: Vec<PassiveElementItem> = reader.into_iter().collect::<Result<Vec<_>>>()?;
+        Ok(elements.into_boxed_slice())
+    }
+
     fn read_function_body(&mut self) -> Result<()> {
         if self.section_entries_left == 0 {
             self.current_function_body = None;
@@ -914,7 +934,7 @@ impl<'a> Parser<'a> {
                 self.read_init_expression_body(InitExpressionContinuationSection::Global)
             }
             ParserState::EndGlobalSectionEntry => self.read_global_entry()?,
-            ParserState::BeginPassiveElementSectionEntry(_) => self.read_element_entry_body()?,
+            ParserState::PassiveElementSectionEntry { .. } => self.read_element_entry()?,
             ParserState::BeginActiveElementSectionEntry(_) => {
                 self.read_init_expression_body(InitExpressionContinuationSection::Element)
             }

src/readers/element_section.rs

@@ -115,18 +115,40 @@ impl<'a> Iterator for ActiveElementItemsIterator<'a> {
 
 #[derive(Clone)]
 pub struct PassiveElementItems<'a> {
+    offset: usize,
+    data: &'a [u8],
     amt: u32,
-    reader: OperatorsReader<'a>,
 }
 
+impl<'a> PassiveElementItems<'a> {
+    pub fn get_items_reader<'b>(&self) -> Result<PassiveElementItemsReader<'b>>
+    where
+        'a: 'b,
+    {
+        PassiveElementItemsReader::new(self.data, self.offset, self.amt)
+    }
+}
+
+#[derive(Debug, Clone)]
 pub enum PassiveElementItem {
     Null,
     Func(u32),
 }
 
-impl<'a> PassiveElementItems<'a> {
+#[derive(Clone)]
+pub struct PassiveElementItemsReader<'a> {
+    reader: OperatorsReader<'a>,
+    count: u32,
+}
+
+impl<'a> PassiveElementItemsReader<'a> {
+    pub fn new(data: &[u8], offset: usize, count: u32) -> Result<PassiveElementItemsReader> {
+        let reader = OperatorsReader::new(data, offset);
+        Ok(PassiveElementItemsReader { reader, count })
+    }
+
     pub fn get_count(&self) -> u32 {
-        self.amt
+        self.count
     }
 
     pub fn read(&mut self) -> Result<PassiveElementItem> {
@@ -149,14 +171,46 @@ impl<'a> PassiveElementItems<'a> {
                 })
             }
         }
-        self.amt -= 1;
-        if self.amt == 0 {
-            self.reader.ensure_end()?;
-        }
         Ok(ret)
     }
 }
 
+impl<'a> IntoIterator for PassiveElementItemsReader<'a> {
+    type Item = Result<PassiveElementItem>;
+    type IntoIter = PassiveElementItemsIterator<'a>;
+    fn into_iter(self) -> Self::IntoIter {
+        let count = self.count;
+        PassiveElementItemsIterator {
+            reader: self,
+            left: count,
+            err: false,
+        }
+    }
+}
+
+pub struct PassiveElementItemsIterator<'a> {
+    reader: PassiveElementItemsReader<'a>,
+    left: u32,
+    err: bool,
+}
+
+impl<'a> Iterator for PassiveElementItemsIterator<'a> {
+    type Item = Result<PassiveElementItem>;
+    fn next(&mut self) -> Option<Self::Item> {
+        if self.err || self.left == 0 {
+            return None;
+        }
+        let result = self.reader.read();
+        self.err = result.is_err();
+        self.left -= 1;
+        Some(result)
+    }
+    fn size_hint(&self) -> (usize, Option<usize>) {
+        let count = self.reader.get_count() as usize;
+        (count, Some(count))
+    }
+}
+
 pub struct ElementSectionReader<'a> {
     reader: BinaryReader<'a>,
     count: u32,
@@ -184,7 +238,8 @@ impl<'a> ElementSectionReader<'a> {
     /// # let data: &[u8] = &[0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00,
     /// #     0x01, 0x4, 0x01, 0x60, 0x00, 0x00, 0x03, 0x02, 0x01, 0x00,
     /// #     0x05, 0x03, 0x01, 0x00, 0x02,
-    /// #     0x09, 0x07, 0x01, 0x00, 0x41, 0x00, 0x0B, 0x01, 0x00,
+    /// #     0x09, 0x0F, 0x02, 0x00, 0x41, 0x00, 0x0B, 0x01, 0x00,
+    /// #     0x01, 0x70, 0x02, 0xD0, 0x0B, 0xD2, 0x00, 0x0B,
     /// #     0x0a, 0x05, 0x01, 0x03, 0x00, 0x01, 0x0b];
     /// use wasmparser::{ModuleReader, ElementKind};
     ///use wasmparser::Result;
@@ -206,6 +261,14 @@ impl<'a> ElementSectionReader<'a> {
     ///             println!("  Item: {}", item);
     ///         }
     ///     }
+    ///     if let ElementKind::Passive { ty, items } = element.kind {
+    ///         println!("Type: {:?}", ty);
+    ///         let mut items_reader = items.get_items_reader().expect("items reader");
+    ///         for _ in 0..items_reader.get_count() {
+    ///             let item = items_reader.read().expect("item");
+    ///             println!("  Item: {:?}", item);
+    ///         }
+    ///     }
     /// }
     /// ```
     pub fn read<'b>(&mut self) -> Result<Element<'b>>
@@ -217,24 +280,14 @@ impl<'a> ElementSectionReader<'a> {
             let ty = self.reader.read_type()?;
             let amt = self.reader.read_var_u32()?;
             let data_start = self.reader.position;
-            let mut reader = OperatorsReader {
-                reader: self.reader.clone(),
-            };
             for _ in 0..amt {
-                loop {
-                    if let Operator::End = reader.read()? {
-                        break;
-                    }
-                }
+                self.reader.skip_init_expr()?;
             }
-            self.reader = reader.reader;
             let data_end = self.reader.position;
             let items = PassiveElementItems {
                 amt,
-                reader: OperatorsReader::new(
-                    &self.reader.buffer[data_start..data_end],
-                    self.reader.original_offset + data_start,
-                ),
+                offset: self.reader.original_offset + data_start,
+                data: &self.reader.buffer[data_start..data_end],
             };
             ElementKind::Passive { ty, items }
         } else {

src/readers/mod.rs

@@ -35,6 +35,7 @@ pub use self::element_section::ElementKind;
 pub use self::element_section::ElementSectionReader;
 pub use self::element_section::PassiveElementItem;
 pub use self::element_section::PassiveElementItems;
+pub use self::element_section::PassiveElementItemsReader;
 pub use self::export_section::Export;
 pub use self::export_section::ExportSectionReader;
 pub use self::function_section::FunctionSectionReader;

src/validator.rs

@@ -523,7 +523,7 @@ impl<'a> ValidatingParser<'a> {
             ParserState::DataCountSectionEntry(count) => {
                 self.resources.data_count = Some(count);
             }
-            ParserState::BeginPassiveElementSectionEntry(_ty) => {
+            ParserState::PassiveElementSectionEntry { .. } => {
                 self.resources.element_count += 1;
             }
             ParserState::BeginActiveElementSectionEntry(table_index) => {