Bug 1363431: wasm: Check for maximum br_table size; r?luke
MozReview-Commit-ID: 2Q2pWi5NSn7
--- a/js/src/wasm/WasmBinaryIterator.h
+++ b/js/src/wasm/WasmBinaryIterator.h
@@ -1076,16 +1076,19 @@ OpIter<Policy>::readBrTable(Uint32Vector
ExprType* branchValueType, Value* branchValue, Value* index)
{
MOZ_ASSERT(Classify(op_) == OpKind::BrTable);
uint32_t tableLength;
if (!readVarU32(&tableLength))
return fail("unable to read br_table table length");
+ if (tableLength > MaxBrTableElems)
+ return fail("br_table too big");
+
if (!popWithType(ValType::I32, index))
return false;
if (!depths->resize(tableLength))
return false;
*branchValueType = ExprType::Limit;