Skip to content

Stack-buffer-underflow in VMTag::get from recursive try_table/throw #6774

Description

@teyahb8

Describe the bug

A minimal WebAssembly module using exception handling (try_table/throw) triggers a stack-buffer-underflow crash in LLVM mode.

$> wasmer -vV; rustc -vV
wasmer 7.2.0-alpha.1
binary: wasmer-cli
commit-hash: 89ce1989711550e0212592943defae9500b4e2a7
commit-date: 2026-07-06
host: x86_64-unknown-linux-gnu
CPU flags: sse2 sse3 ssse3 sse4.1 sse4.2 popcnt avx bmi bmi2 avx2 avx512dq avx512vl avx512f lzcnt fma
runtimes: Singlepass, Cranelift, LLVM
features: wasix
rustc 1.99.0-nightly (3659db0d3 2026-07-05)
binary: rustc
commit-hash: 3659db0d3e2cd634c766fcda79ed118eca31a9fd
commit-date: 2026-07-05
host: x86_64-unknown-linux-gnu
release: 1.99.0-nightly
LLVM version: 22.1.8

Steps to reproduce

  1. Convert the following test case to wasm:
(module
  (tag)
  (func (export "main")
    block
      try_table (catch 0 0)
        throw 0
      end
    end
    call 0
  )
)
  1. Run wasmer run --llvm poc.wasm --invoke main
==2253694==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7bfeb7677c60 at pc 0x55555fc62b0f bp 0x7bfeb7677bb0 sp 0x7bfeb7677ba8
READ of size 8 at 0x7bfeb7677c60 thread T0
    #0 0x55555fc62b0e in <wasmer_vm::store::InternalStoreHandle<wasmer_vm::export::VMTag>>::get wasmer/lib/vm/src/store.rs:283:23
    #1 0x55555fc885af in <wasmer_vm::exception::VMExceptionObj>::new_zeroed wasmer/lib/vm/src/exception.rs:33:31
    #2 0x55555fc7f6ed in wasmer_vm_alloc_exception wasmer/lib/vm/src/libcalls.rs:750:15

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions