[AOT] Validate AOT section header fields

Signed-off-by: Shen-Ta Hsieh <beststeve@secondstate.io>
DecFox · Nov 2, 2023 · 7d4213b · 7d4213b
1 parent e63e8ee
commit 7d4213b
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/lib/loader/shared_library.cpp b/lib/loader/shared_library.cpp
@@ -96,7 +96,10 @@ Expect<void> SharedLibrary::load(const AST::AOTSection &AOTSec) noexcept {
     const auto Offset = std::get<1>(Section);
     const auto Size = std::get<2>(Section);
     const auto &Content = std::get<3>(Section);
-    assuming(Content.size() <= Size);
+    if (Size > BinarySize || Offset > BinarySize ||
+        Offset + Size > BinarySize || Content.size() > Size) {
+      return Unexpect(ErrCode::Value::IntegerTooLarge);
+    }
     std::copy(Content.begin(), Content.end(), Binary + Offset);
     switch (std::get<0>(Section)) {
     case 1: { // Text
@@ -116,6 +119,8 @@ Expect<void> SharedLibrary::load(const AST::AOTSection &AOTSec) noexcept {
           static_cast<uint32_t>(Size / sizeof(winapi::RUNTIME_FUNCTION_));
       break;
 #endif
+    default:
+      return Unexpect(ErrCode::Value::IntegerTooLarge);
     }
   }