← WebKit — 2026-W39
03befd703d60bd42acca6f8a5b364bea0da804d5 Wasm RTT should be compact-allocated
severity medium
class TypeConfusion
confidence 0.5
signal score 7.77
Source/JavaScriptCore/wasm
Primitive: Wasm RTT/Projection allocated with non-compact malloc but referenced via CompactPtr that truncates/strips tags
Triage note: Switches RTT allocation to FastCompactMalloc and m_projectionStorage to FastCompactMalloc with a comment that projections are referenced via compact pointers that strip MTE tags; corrects an allocation-region invariant that compact pointers depend on, but no concrete attacker-controlled corruption is demonstrated in this diff.
Triage note: Switches RTT allocation to FastCompactMalloc and m_projectionStorage to FastCompactMalloc with a comment that projections are referenced via compact pointers that strip MTE tags; corrects an allocation-region invariant that compact pointers depend on, but no concrete attacker-controlled corruption is demonstrated in this diff.
Structural signals: null_guard (+2.59), clamp_saturate (+3.88), surgical (+1.3)
Commit message
Wasm RTT should be compact-allocated
https://bugs.webkit.org/show_bug.cgi?id=323513
rdar://186751068
Reviewed by Vassili Bykov and Yusuke Suzuki.
While Wasm's RTT class is marked
WTF_DEPRECATED_MAKE_FAST_COMPACT_ALLOCATED, the actual
backing memory is allocated internally via tryFastMalloc.
This breaks when the object is plugged into a CompactPointerTuple,
but only when MTE is enabled. Practically, that means only
lockdown mode and ES WCPs, and only on sites that use wasm.
This patch fixes that by using the compact malloc instead.
* Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp:
(JSC::Wasm::RTT::tryCreateFunction):
(JSC::Wasm::RTT::tryCreateStruct):
(JSC::Wasm::RTT::tryCreateArray):
* Source/JavaScriptCore/wasm/WasmTypeDefinition.h:
* Source/JavaScriptCore/wasm/WasmTypeSectionState.h:
Canonical link: https://commits.webkit.org/321946@main
Before / after
Loading diff…
On This Page