Re:Ask HN: Does Compiling to WebAssembly Prevent Issues with...
by fwsgonzo on Friday November 03, 2023 @10:41AM
(#38129523)
Are you sure the run-time will bounds-check buffers like that? I thought WASM sandboxes were just one big bump-allocator arena.
Re:Ask HN: Does Compiling to WebAssembly Prevent Issues with...
by averageValentin on Friday November 03, 2023 @07:04PM
(#38136222)
Appreciate the clarification. You're right that WebAssembly doesn't enforce bounds checking within its linear memory, allowing for out-of-bounds writes within the allocated space. While it does enhance security at the host boundary, it doesn't absolve the need for careful memory management within the WebAssembly module itself
Take this C function: void write_to_buffer(char *buffer, unsigned int size, char value) { for (unsigned int i = 0; i <= size; ++i) { buffer[i] = value; // Unsafe: can write past the buffer if size is too large } }
Compiled to native code, an incorect size can lead to a buffer overflow. However, if you compile this to WebAssembly, the out-of-bounds write would be caught by the WebAssembly runtime, preventing a potential security flaw. But it doesn't eliminate the need for good coding practices, it does add a layer of protection against some kinds of memory-related errors