Skip to content

Fix/branch hint parse issue#4878

Merged
lum1n0us merged 5 commits intobytecodealliance:mainfrom
srberard:fix/branch-hint-parse-issue
Mar 20, 2026
Merged

Fix/branch hint parse issue#4878
lum1n0us merged 5 commits intobytecodealliance:mainfrom
srberard:fix/branch-hint-parse-issue

Conversation

@srberard
Copy link
Contributor

This PR fixes two security issues in experimental branch hint support (WASM_ENABLE_BRANCH_HINTS=1) reported by @Finder16.

Summary

  • Fixes incorrect memory deallocation in branch hint parsing that could corrupt the heap and crash the loader.
  • Adds validation to prevent unbounded allocation/loops from malformed branch-hint sections.
  • Impact: a malformed Wasm module can trigger a loader crash or before any Wasm code executes.

These issues only affect builds with branch hints enabled, which is currently an experimental, opt-in feature.

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds build-time support and documentation for the Branch Hints feature, hardens the wasm loader’s branch-hint custom section parsing, and introduces regression coverage for related loader issues.

Changes:

  • Add WAMR_BUILD_BRANCH_HINTS build flag wiring and update build/reporting output.
  • Add loader-side validation for branch hint counts/offsets and adjust logging when hints are present but disabled.
  • Add regression test cases and sample .wasm fixtures for branch-hint loader failures.

Reviewed changes

Copilot reviewed 7 out of 9 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
core/iwasm/interpreter/wasm_loader.c Adds branch-hint validation (count/offset), introduces branch-instruction counting helper, adjusts logging severity when feature disabled.
build-scripts/config_common.cmake Adds build configuration message + definition to enable WASM_ENABLE_BRANCH_HINTS.
tests/regression/ba-issues/build_wamr.sh Adds a dedicated iwasm build variant with branch hints enabled for regression runs.
tests/regression/ba-issues/running_config.json Registers two new regression test entries for branch-hint loader failures.
tests/regression/ba-issues/issues/issue-980002/create_samples.py Adds script to generate the crafted branch-hint .wasm samples.
tests/regression/ba-issues/issues/issue-980002/branch_hint_invalid_free.wasm Adds crafted wasm fixture for invalid hint sizing/structure.
tests/regression/ba-issues/issues/issue-980003/branch_hint_null_deref.wasm Adds crafted wasm fixture for oversized hint-count input.
doc/build_wamr.md Documents the WAMR_BUILD_BRANCH_HINTS option and intent.
doc/tiered_support.md Lists Branch Hints in the tiered support matrix with a link to build documentation.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

srberard and others added 5 commits March 19, 2026 06:54
Signed-off-by: Stephen Berard <stephen.berard@outlook.com>
Signed-off-by: Stephen Berard <stephen.berard@outlook.com>
```bash
$ pwd
/workspaces/wasm-micro-runtime/tests/regression/ba-issues

$ ./run.py -i 980002,980003
```
@srberard srberard force-pushed the fix/branch-hint-parse-issue branch from ceafe3d to 3b88f0e Compare March 19, 2026 06:59
@srberard
Copy link
Contributor Author

Rebased.

@lum1n0us lum1n0us merged commit fcec30e into bytecodealliance:main Mar 20, 2026
830 of 836 checks passed
@lum1n0us lum1n0us linked an issue Mar 20, 2026 that may be closed by this pull request
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] Branch-hint custom section parsing can corrupt heap

3 participants