WebAssembly Wabt Heap-Based Buffer Overflow Vulnerability in Binary Reader Interp Function

A critical heap-based buffer overflow vulnerability has been identified in WebAssembly Wabt version 1.0.36. The issue arises in the BinaryReaderInterp::GetReturnCallDropKeepCount function, located in binary-reader-interp.cc. This vulnerability can be exploited remotely and is caused by improper boundary checking when the function processes files with certain formatting errors. The lack of adequate validation allows read operations to exceed allocated memory, potentially leading to application crashes.

Impact

Exploitation of this vulnerability causes a heap-based buffer overflow, which can lead to memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by compiling Wabt with AddressSanitizer enabled, which will detect memory errors. After building Wabt, a fuzzer can be used to send crafted input to the BinaryReaderInterp::GetReturnCallDropKeepCount function. This input should exploit the lack of boundary checking, causing a heap-buffer-overflow error. The AddressSanitizer will report this memory error, indicating that the vulnerability has been successfully exploited.