From 48d6a8e25ccf9ee9faf84d601a9b52607b1a15dd Mon Sep 17 00:00:00 2001 From: Roman Volosatovs Date: Fri, 9 Oct 2026 18:00:29 +0200 Subject: [PATCH] component(err-ctx): trap on a misaligned pointer `error-context.debug-message` bounds-checked the guest-provided destination pointer for the string's `(ptr, len)` pair, but not its alignment, and then wrote the pair via `::linear_lower_to_memory`, which `debug_assert!`s that the offset is 4-byte aligned. A guest passing an in-bounds but misaligned pointer could therefore panic the host in debug builds, while release builds performed the unaligned write. Check the pointer's alignment before lowering and trap with "invalid debug message pointer: not aligned", the same way the stream/future read and write paths in this file report misaligned pointers. Assisted-by: claude:claude-opus-5-5 Signed-off-by: Roman Volosatovs --- .../src/runtime/component/concurrent/futures_and_streams.rs | 3 +++ .../misc_testsuite/component-model/async/error-context.wast | 6 ++++++ 2 files changed, 9 insertions(+) diff --git a/crates/wasmtime/src/runtime/component/concurrent/futures_and_streams.rs b/crates/wasmtime/src/runtime/component/concurrent/futures_and_streams.rs index bd83bb388e89..faed6fea092a 100644 --- a/crates/wasmtime/src/runtime/component/concurrent/futures_and_streams.rs +++ b/crates/wasmtime/src/runtime/component/concurrent/futures_and_streams.rs @@ -4389,6 +4389,9 @@ impl Instance { let lower_cx = &mut LowerContext::new(store, options, self); let debug_msg_address = usize::try_from(debug_msg_address)?; + if debug_msg_address % usize::try_from(::ALIGN32)? != 0 { + bail!("invalid debug message pointer: not aligned"); + } // Lower the string into the component's memory. // // Note that the "8" here is the size of a WIT `string` in linear diff --git a/tests/misc_testsuite/component-model/async/error-context.wast b/tests/misc_testsuite/component-model/async/error-context.wast index 217ed80260fc..17310c46a3e1 100644 --- a/tests/misc_testsuite/component-model/async/error-context.wast +++ b/tests/misc_testsuite/component-model/async/error-context.wast @@ -84,3 +84,9 @@ (component instance $A $A) (assert_return (invoke "run" (u32.const 65528))) (assert_trap (invoke "run" (u32.const 65532)) "invalid debug message pointer") + +(component instance $A2 $A) +(assert_trap (invoke "run" (u32.const 1)) "invalid debug message pointer: not aligned") + +(component instance $A3 $A) +(assert_trap (invoke "run" (u32.const 65526)) "invalid debug message pointer: not aligned")