Skip to content

Commit 3d5a10d

Browse files
authored
Fuzzer: Avoid massive initial sizes for memories (#7305)
We generate random segments and then make the memory's initial size big enough to accomodate them, but if the size is massive then we will just OOM anyhow (or even not validate in wasm32 in some cases). To avoid that, put a limit on the maximum initial memory size as influenced by segments.
1 parent 613ea88 commit 3d5a10d

File tree

1 file changed

+12
-3
lines changed

1 file changed

+12
-3
lines changed

src/tools/fuzzing/fuzzing.cpp

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -753,9 +753,18 @@ void TranslateToFuzzReader::finalizeMemory() {
753753
maxOffset = maxOffset + offset->value.getInteger();
754754
}
755755
}
756-
memory->initial = std::max(
757-
memory->initial,
758-
Address((maxOffset + Memory::kPageSize - 1) / Memory::kPageSize));
756+
757+
// Ensure the initial memory can fit the segment (so we don't just trap),
758+
// but only do so when the segment is at a reasonable offset (to avoid
759+
// validation errors on the initial size >= 4GB in wasm32, but also to
760+
// avoid OOM errors on trying to allocate too much initial memory, which is
761+
// annoying in the fuzzer).
762+
Address ONE_GB = 1024 * 1024 * 1024;
763+
if (maxOffset <= ONE_GB) {
764+
memory->initial = std::max(
765+
memory->initial,
766+
Address((maxOffset + Memory::kPageSize - 1) / Memory::kPageSize));
767+
}
759768
}
760769
memory->initial = std::max(memory->initial, fuzzParams->USABLE_MEMORY);
761770
// Avoid an unlimited memory size, which would make fuzzing very difficult

0 commit comments

Comments
 (0)