Skip to content

guard guest cursor and delta in wasi-keyvalue in-memory store#13819

Open
netliomax25-code wants to merge 1 commit into
bytecodealliance:mainfrom
netliomax25-code:keyvalue-guard-cursor-delta
Open

guard guest cursor and delta in wasi-keyvalue in-memory store#13819
netliomax25-code wants to merge 1 commit into
bytecodealliance:mainfrom
netliomax25-code:keyvalue-guard-cursor-delta

Conversation

@netliomax25-code

Copy link
Copy Markdown
Contributor
  1. list_keys casts the guest-supplied cursor with as usize and slices &keys[cursor..], so a cursor past the number of keys panics the host with an out-of-range slice, and the cast also truncates the u64 on 32-bit hosts.
  2. increment computes current_value + delta, which panics on overflow in debug builds and silently wraps to a smaller value in release, so the returned counter can go backwards.

Clamped the cursor to keys.len() (via try_from + min) and switched increment to checked_add, returning an error on overflow. Both values come straight from the guest, so the checks live in the callee. Added unit tests that panic on the current code and pass with the fix.

@netliomax25-code netliomax25-code requested a review from a team as a code owner July 5, 2026 09:52
@netliomax25-code netliomax25-code requested review from dicej and removed request for a team July 5, 2026 09:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant