5 ms·

This line: https://github.com/grassel/wac-esp/blob/master/main/wa.c#L683 https://github.com/grassel/wac-esp/blob/master/main/wa.c#L68... What prevents me from

This line: https://github.com/grassel/wac-esp/blob/master/main/wa.c#L683 https://github.com/grassel/wac-esp/blob/master/main/wa.c#L68... What prevents me from writing a wasm file with an arbitrary value for "depth" greater than CALLSTACK_SIZE (1024) and overflowing the buffer? (If the answer is "nothing", that's probably arbitrary code execution.)

rcfox 8y ago
You should probably write this in an issue so that the developers see it.
- pcwalton 8y ago
  It took me 10 minutes to find on my phone on the train. There are probably dozens of bugs like this...
  - JeremyBanks 8y ago
    Well, it is written in C...
    - bexsella 8y ago
      I knew it would only be a matter of time before someone mentioned this, although I was actually expecting someone to mention a specific alternate language.
      - pjmlp 8y ago
        Want to use C? Fine. But then actually use the myriad of compiler flags, static analysers and dependent typing tooling (Frama-C) available for it. Some of them exist since 1979.
  - newacct123 8y ago
    I bet it has a lot of bugs. Because it exists. Unlike a lot of “safe” Rust software ;)
  - taf2 8y ago
    “Unless someone like you cares a whole awful lot, nothing is going to get better. It's not.“ - dr. seuss
    - devwastaken 8y ago
      That's an unreasonable expectation. Security is not left to bug fixes. It is a skill developed by overall knowledge of the domain, and an explicit intent to be conscious of how what you write can be misused. If someone can scan your repo for a problem this quickly, then youre not designing secure software, and that should be posted front and center at the top of the repo given that wasms entire purpose is machine independent code that is properly sandboxed from exploitation.
int_19h 8y ago
Is it meant to be a sandbox? I don't see anything to that effect on the GitHub page.
- sitkack 8y ago
  When is Wasm not a sandbox? Page one of the spec – Safe: code is validated and executes in a memory-safe3, sandboxed environment preventing data cor-ruption or security breaches.
  - kllrnohj 8y ago
    Doesn't mean the runtime needs to provide that sandbox. If the only thing in the process is the WASM runtime & the WASM code then you don't need the runtime to do any sandboxing - the kernel already did that for you.
    - nickmooney 8y ago
      I'm not sure I agree. If you can affect the state of the runtime in ways that are not intended to be possible by the WASM API, this breaks sandboxing requirements. Even if you can't break out of the current process (due to isolation provided by the kernel), you can still cause arbitrary code execution within the process.
      - int_19h 8y ago
        WASM is originally designed for the sandbox, but it doesn't mean that all its practical applications have to be sandboxed.
        sitkack 8y ago
        Wasm (not an acronym) assumes a sandbox, if an execution environment doesn't provide a sandbox it needs to clearly call that out. This one clearly needs work in validating the Wasm sent to it.

rcfox 8y ago

You should probably write this in an issue so that the developers see it.

pcwalton 8y ago
It took me 10 minutes to find on my phone on the train. There are probably dozens of bugs like this...
- JeremyBanks 8y ago
  Well, it is written in C...
  - bexsella 8y ago
    I knew it would only be a matter of time before someone mentioned this, although I was actually expecting someone to mention a specific alternate language.
    - pjmlp 8y ago
      Want to use C? Fine. But then actually use the myriad of compiler flags, static analysers and dependent typing tooling (Frama-C) available for it. Some of them exist since 1979.
- newacct123 8y ago
  I bet it has a lot of bugs. Because it exists. Unlike a lot of “safe” Rust software ;)
- taf2 8y ago
  “Unless someone like you cares a whole awful lot, nothing is going to get better. It's not.“ - dr. seuss
  - devwastaken 8y ago
    That's an unreasonable expectation. Security is not left to bug fixes. It is a skill developed by overall knowledge of the domain, and an explicit intent to be conscious of how what you write can be misused. If someone can scan your repo for a problem this quickly, then youre not designing secure software, and that should be posted front and center at the top of the repo given that wasms entire purpose is machine independent code that is properly sandboxed from exploitation.

int_19h 8y ago

Is it meant to be a sandbox? I don't see anything to that effect on the GitHub page.

sitkack 8y ago
When is Wasm not a sandbox? Page one of the spec – Safe: code is validated and executes in a memory-safe3, sandboxed environment preventing data cor-ruption or security breaches.
- kllrnohj 8y ago
  Doesn't mean the runtime needs to provide that sandbox. If the only thing in the process is the WASM runtime & the WASM code then you don't need the runtime to do any sandboxing - the kernel already did that for you.
  - nickmooney 8y ago
    I'm not sure I agree. If you can affect the state of the runtime in ways that are not intended to be possible by the WASM API, this breaks sandboxing requirements. Even if you can't break out of the current process (due to isolation provided by the kernel), you can still cause arbitrary code execution within the process.
    - int_19h 8y ago
      WASM is originally designed for the sandbox, but it doesn't mean that all its practical applications have to be sandboxed.
      - sitkack 8y ago
        Wasm (not an acronym) assumes a sandbox, if an execution environment doesn't provide a sandbox it needs to clearly call that out. This one clearly needs work in validating the Wasm sent to it.