Skip to content

Copy/paste bug in ReadU64LEB128 #2192

Description

@kssreeram

In file wabt/src/leb128.cc, function ReadU64Leb128:

This snippet is incorrect. It appears to have been copied from ReadU32Leb128:

else if (p + 9 < end && (p[9] & 0x80) == 0) {
  // The top bits set represent values > 32 bits.
  if (p[9] & 0xf0) {
    return 0;
  }
  *out_value = LEB128_10(uint64_t);
  return 10;
}

The right code is:

else if (p + 9 < end && (p[9] & 0x80) == 0) {
  // The top bits set represent values > 64 bits.
  if (p[9] & 0xfe) {
    return 0;
  }
  *out_value = LEB128_10(uint64_t);
  return 10;
}

The number of used bits in byte 10 equals 64 - 9*7 = 1 bit. Only one bit in the final byte is a part of the 64-bit value. Therefore, all the remaining 7 bits of the last byte must be zero. The check for that is if (p[9] & 0xfe) {.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions