Skip to content

Stack-buffer-overflow in wasmer_vm_table_grow when recursively growing table after exception handling #6775

Description

@teyahb8

Describe the bug

A minimal WebAssembly module using exception handling, table.grow, and recursive call_indirect triggers a stack-buffer-overflow in LLVM mode.

$> wasmer -vV; rustc -vV
wasmer 7.2.0-alpha.1
binary: wasmer-cli
commit-hash: 89ce1989711550e0212592943defae9500b4e2a7
commit-date: 2026-07-06
host: x86_64-unknown-linux-gnu
CPU flags: sse2 sse3 ssse3 sse4.1 sse4.2 popcnt avx bmi bmi2 avx2 avx512dq avx512vl avx512f lzcnt fma
runtimes: Singlepass, Cranelift, LLVM
features: wasix
rustc 1.99.0-nightly (3659db0d3 2026-07-05)
binary: rustc
commit-hash: 3659db0d3e2cd634c766fcda79ed118eca31a9fd
commit-date: 2026-07-05
host: x86_64-unknown-linux-gnu
release: 1.99.0-nightly
LLVM version: 22.1.8

Steps to reproduce

  1. Convert the following test case to wasm:
(module
  (type (func (result i32)))
  (table 0 funcref)
  (tag)
  (func (export "main") (result i32)
    block
      try_table (catch 0 0)
        throw 0
      end
    end
    ref.func 0
    i32.const 1
    table.grow 0
    call_indirect (type 0)
  )
  (elem declare func 0)
)
  1. Run: wasmer run --llvm poc.wasm --invoke main

Actual behavior

==2257939==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7bfeb76b4ce0 at pc 0x55555fc6f863 bp 0x7fffffffcdd0 sp 0x7fffffffcdc8
READ of size 8 at 0x7bfeb76b4ce0 thread T0
    #0 0x55555fc6f862 in wasmer_vm::libcalls::wasmer_vm_table_grow::{closure#0} wasmer/lib/vm/src/libcalls.rs:478:56
    #1 0x55555fc6f862 in wasmer_vm::trap::traphandlers::on_host_stack::<wasmer_vm::libcalls::wasmer_vm_table_grow::{closure#0}, u32>::{closure#1} wasmer/lib/vm/src/trap/traphandlers.rs:1127:9
    #2 0x55555fc6f862 in <core::panic::unwind_safe::AssertUnwindSafe<wasmer_vm::trap::traphandlers::on_host_stack<wasmer_vm::libcalls::wasmer_vm_table_grow::{closure#0}, u32>::{closure#1}> as core::ops::function::FnOnce<()>>::call_once .rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/panic/unwind_safe.rs:275:9
    #3 0x55555fc6f862 in std::panicking::catch_unwind::do_call::<core::panic::unwind_safe::AssertUnwindSafe<wasmer_vm::trap::traphandlers::on_host_stack<wasmer_vm::libcalls::wasmer_vm_table_grow::{closure#0}, u32>::{closure#1}>, u32> .rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:576:43
    #4 0x55555fc727d1 in __rust_try wasmer_vm.56cc96b25fcc60cf-cgu.05
    #5 0x55555fc6ef9f in std::panicking::catch_unwind::<u32, core::panic::unwind_safe::AssertUnwindSafe<wasmer_vm::trap::traphandlers::on_host_stack<wasmer_vm::libcalls::wasmer_vm_table_grow::{closure#0}, u32>::{closure#1}>> .rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:544:19
    #6 0x55555fc6ef9f in std::panic::catch_unwind::<core::panic::unwind_safe::AssertUnwindSafe<wasmer_vm::trap::traphandlers::on_host_stack<wasmer_vm::libcalls::wasmer_vm_table_grow::{closure#0}, u32>::{closure#1}>, u32> .rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panic.rs:359:14
    #7 0x55555fc6ef9f in corosensei::unwind::catch_unwind_at_root::<u32, wasmer_vm::trap::traphandlers::on_host_stack<wasmer_vm::libcalls::wasmer_vm_table_grow::{closure#0}, u32>::{closure#1}> .cargo/registry/src/index.crates.io-1949cf8c6b5b557f/corosensei-0.3.3/src/unwind.rs:233:13

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions