Skip to content

wasmer_vm_throw missing stack headroom check causes stack-buffer-overflow on deep recursion #6793

Description

@phihuthan

Describe the bug

Unbounded recursion where each frame also does a throw/catch round-trip causes a stack-buffer-overflow via wasmer_vm_throw. Native stack is exhausted right after throw, leaving no space for the runtime's own unwind bookkeeping, so it corrupts memory instead of trapping cleanly.

wasmer -vV; rustc -vV

Output: 

wasmer 7.2.0-alpha.1
binary: wasmer-cli
commit-hash: 89ce1989711550e0212592943defae9500b4e2a7
commit-date: 2026-07-06
host: x86_64-unknown-linux-gnu
CPU flags: sse2 sse3 ssse3 sse4.1 sse4.2 popcnt avx bmi bmi2 avx2 avx512dq avx512vl avx512f lzcnt fma
runtimes: Singlepass, Cranelift, LLVM
features: wasix
rustc 1.99.0-nightly (3659db0d3 2026-07-05)
binary: rustc
commit-hash: 3659db0d3e2cd634c766fcda79ed118eca31a9fd
commit-date: 2026-07-05
host: x86_64-unknown-linux-gnu
release: 1.99.0-nightly
LLVM version: 22.1.8

Steps to reproduce

Testcase:
test.wasm.txt
test.wat.txt

  1. Rename test.wasm.txt to test.wasm
  2. CLI command to run: wasmer run --llvm test.wasm --invoke main

Expected behavior

The test module should normally trap.

Actual behavior

The following crash occurs:

==3071464==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7bfeb76d8c78 at pc 0x55555953bcee bp 0x7bfeb76d8c50 sp 0x7bfeb76d8428
WRITE of size 24 at 0x7bfeb76d8c78 thread T0
    #0 0x55555953bced in sigaltstack (wasmer/target/x86_64-unknown-linux-gnu/release/wasmer+0x3fe7ced) (BuildId: 3a60d0e7d76d2907133901be07e0feb278ed431e)
    #1 0x55555955c7e9 in __asan::PlatformUnpoisonStacks() asan_posix.cpp
    #2 0x5555595609fc in __asan_handle_no_return (wasmer/target/x86_64-unknown-linux-gnu/release/wasmer+0x400c9fc) (BuildId: 3a60d0e7d76d2907133901be07e0feb278ed431e)
    #3 0x55555fc82864 in wasmer_vm_throw wasmer/lib/vm/src/libcalls.rs:737:14

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions