Skip to content

Commit cd01430

Browse files
committed
[lld][WebAssembly] Allow data symbols to extend past end of segment
This fixes a bug with string merging with string symbols that contain NULLs, as is the case in the `merge-string.s` test. The bug only showed when we run with `--relocatable` and then try read the resulting object back in. In this case we would end up with string symbols that extend past the end of the segment in which they live. The problem comes from the fact that sections which are flagged as string mergable assume that all strings are NULL terminated. The merging algorithm will drop trailing chars that follow a NULL since they are essentially unreachable. However, the "size" attribute (in the symbol table) of such a truncated symbol is not updated resulting a symbol size that can overlap the end of the segment. I verified that this can happen in ELF too given the right conditions and the its harmless enough. In practice Strings that contain embedded null should not be part of a mergable section. Differential Revision: https://reviews.llvm.org/D102281
1 parent 3041b16 commit cd01430

File tree

3 files changed

+63
-4
lines changed

3 files changed

+63
-4
lines changed

lld/test/wasm/merge-string.s

+26-1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@
1010
// RUN: wasm-ld -O0 %t.o -o %t2.wasm --no-gc-sections --no-entry
1111
// RUN: obj2yaml %t2.wasm | FileCheck --check-prefixes=COMMON,NOMERGE %s
1212

13+
// Check relocatable
14+
// RUN: wasm-ld -r %t.o -o %t2.o
15+
// RUN: obj2yaml %t2.o | FileCheck --check-prefixes=RELOC %s
16+
1317
.section .rodata1,"S",@
1418
.asciz "abc"
1519
foo:
@@ -18,7 +22,7 @@ foo:
1822
bar:
1923
.asciz "bc"
2024
.asciz "bc"
21-
.size bar, 4
25+
.size bar, 6
2226

2327
.section .rodata_relocs,"",@
2428
negative_addend:
@@ -74,3 +78,24 @@ negative_addend:
7478
// COMMON-NEXT: Value: 1024
7579
// MERGE-NEXT: Content: '61626300'
7680
// NOMERGE-NEXT: Content: '6162630061626300626300'
81+
82+
83+
// RELOC: - Type: DATA
84+
// RELOC-NEXT: Relocations:
85+
// RELOC-NEXT: - Type: R_WASM_MEMORY_ADDR_I32
86+
// RELOC-NEXT: Index: 0
87+
// RELOC-NEXT: Offset: 0xF
88+
// RELOC-NEXT: Addend: -10
89+
// RELOC-NEXT: Segments:
90+
// RELOC-NEXT: - SectionOffset: 6
91+
// RELOC-NEXT: InitFlags: 0
92+
// RELOC-NEXT: Offset:
93+
// RELOC-NEXT: Opcode: I32_CONST
94+
// RELOC-NEXT: Value: 0
95+
// RELOC-NEXT: Content: '61626300'
96+
// RELOC-NEXT: - SectionOffset: 15
97+
// RELOC-NEXT: InitFlags: 0
98+
// RELOC-NEXT: Offset:
99+
// RELOC-NEXT: Opcode: I32_CONST
100+
// RELOC-NEXT: Value: 4
101+
// RELOC-NEXT: Content: F6FFFFFF

llvm/lib/Object/WasmObjectFile.cpp

+6-3
Original file line numberDiff line numberDiff line change
@@ -637,9 +637,12 @@ Error WasmObjectFile::parseLinkingSectionSymtab(ReadContext &Ctx) {
637637
object_error::parse_failed);
638638
auto Offset = readVaruint64(Ctx);
639639
auto Size = readVaruint64(Ctx);
640-
if (Offset + Size > DataSegments[Index].Data.Content.size())
641-
return make_error<GenericBinaryError>("invalid data symbol offset",
642-
object_error::parse_failed);
640+
size_t SegmentSize = DataSegments[Index].Data.Content.size();
641+
if (Offset > SegmentSize)
642+
return make_error<GenericBinaryError>(
643+
"invalid data symbol offset: `" + Info.Name + "` (offset: " +
644+
Twine(Offset) + " segment size: " + Twine(SegmentSize) + ")",
645+
object_error::parse_failed);
643646
Info.DataRef = wasm::WasmDataReference{Index, Offset, Size};
644647
}
645648
break;
+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# RUN: yaml2obj %s | not llvm-objdump -s - 2>&1 | FileCheck %s
2+
3+
# Check that data symbols must have and offset that is within the
4+
# bounds of the containing segment
5+
6+
# CHECK: invalid data symbol offset: `foo` (offset: 42 segment size: 5)
7+
8+
--- !WASM
9+
FileHeader:
10+
Version: 0x00000001
11+
Sections:
12+
- Type: DATA
13+
Segments:
14+
- SectionOffset: 0
15+
InitFlags: 0
16+
Offset:
17+
Opcode: I32_CONST
18+
Value: 0
19+
Content: '6401020304'
20+
- Type: CUSTOM
21+
Name: linking
22+
Version: 2
23+
SymbolTable:
24+
- Index: 0
25+
Kind: DATA
26+
Name: foo
27+
Flags: [ ]
28+
Segment: 0
29+
Offset: 42
30+
Size: 1
31+
...

0 commit comments

Comments
 (0)