Closed Bug 1721765 Opened 3 years ago Closed 3 years ago

Fix crash of wasmboxed libHunspell on debug+no_opt builds

Categories

(Core :: Security: Process Sandboxing, defect, P3)

Desktop
Unspecified
defect

Tracking

()

RESOLVED FIXED
92 Branch
Tracking Status
firefox92 --- fixed

People

(Reporter: shravanrn, Assigned: shravanrn)

References

Details

Attachments

(2 files)

Wasm operates using a safestack model. Safe stack operations (register spilling/restores) are saved on the native stack, while stack arrays (or any stack var you take a pointer to) lives in the so-called unsafe stack, which is one of the regions in wasm's linear memory. The wasm linker unfortunately hardcodes the unsafe stack to 64k. But Hunspell seems to perform a lot of pointer math on the stack --- this is optimized well by clang when optimizations are enabled, but causes an OOM in the unsafe stack on non-optimized builds. We need to modify wasmboxed hunspell to use a larger unsafe stack.

This bug only fixes the issue for the wasm2c wasmboxed library, as we will be moving away from lucet shortly. See bug 1720828

Note we are also changing Wasm's compilation to put the stack before globals. This because this OOM causes a buffer underflow resulting in corription of C globals. Note this is not a security bug as all this occurs inside the wasm linear memory. However, trapping during in OOM is preferable. Putting the stack before globals will result in OOM manifesting as an error (except in the rare case where we are using all 4GB of Wasm's linear memory) as the underflow will wrap to the end of the linear memory.

Pushed by mh@glandium.org: https://hg.mozilla.org/integration/autoland/rev/147efa2b48f4 part 1 - Vendor new wasm2c rlbox plugin, compiler+rt to support large unsafe stack r=glandium https://hg.mozilla.org/integration/autoland/rev/5c7c771620da part 2 - Use larger unsafe stack for hunspell wasm sandbox r=glandium
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → 92 Branch
Blocks: 1758626
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: