Memory flattening: Check for overflow

src/ir/memory-utils.cpp

@@ -15,6 +15,7 @@
  */
 
 #include "ir/memory-utils.h"
+#include "support/safe_math.h"
 #include "wasm.h"
 
 namespace wasm::MemoryUtils {
@@ -94,7 +95,11 @@ bool flatten(Module& wasm) {
   for (auto& segment : dataSegments) {
     auto* offset = segment->offset->dynCast<Const>();
     Index start = offset->value.getInteger();
-    Index end = start + segment->data.size();
+    Index size = segment->data.size();
+    Index end;
+    if (__builtin_add_overflow(start, size, &end)) {
+      return false;
+    }
     if (end > data.size()) {
       data.resize(end);
     }

src/support/safe_math.h

@@ -0,0 +1,38 @@
+/*
+ * Copyright 2024 WebAssembly Community Group participants
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef wasm_safe_math_h
+#define wasm_safe_math_h
+
+namespace wasm {
+
+#if !__has_builtin(__builtin_add_overflow)
+template<typename T> bool __builtin_add_overflow(T a, T b, T* output) {
+  // Atm this only supports unsigned types.
+  static_assert(std::is_unsigned_v<T>);
+
+  T result = a + b;
+  if (result < a) {
+    return true;
+  }
+  *output = result;
+  return false;
+}
+#endif
+
+} // namespace wasm
+
+#endif // wasm_safe_math_h

test/lit/ctor-eval/flatten_overflow.wast

@@ -0,0 +1,16 @@
+;; The data segment here is at an offset too large to fit into the memory due
+;; to an overflow. That will cause us to fail during flatten, so there are no
+;; changes to output here, but we should not error (if we don't check for
+;; overflow, we'd segfault).
+
+;; RUN: wasm-ctor-eval %s --ctors=test --kept-exports=test --quiet -all
+
+(module
+ (memory $0 10 10)
+ (data $0 (i32.const -1) "a")
+
+ (export "test" (func $test))
+
+ (func $test
+ )
+)