1771623 - Wasm Names containing null bytes are truncated

Status: RESOLVED DUPLICATE of bug 1762658

(Core :: JavaScript: WebAssembly, defect)

Description

[Dennis]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0

Steps to reproduce:

Load a wasm module containing two exported functions named A\x00A and A\x00B. The following code will work:

<!DOCTYPE html>
<script>
	var wasmG;
	async function test() {
		let x = [
			0,97,115,109,1,0,0,0,1,14,2,96,2,127,127,1,127,96,3,127,127,127,1,127,3,3,2,0,1,7,13,2,3,
			65,0,65, // first function in export name 'A\x00A'
			0,0,3,
			65,0,66, // second function in export name 'A\x00B'
			0,1,10,20,2,7,0,32,0,32,1,106,11,10,0,32,0,32,1,106,32,2,106,11];
		let y = new Uint8Array(x);
		wasmG = await WebAssembly.instantiate(y);
		console.log(wasmG);
	}
	test();
</script>

Actual results:

Console error Uncaught (in promise) CompileError: wasm validation error: at offset 42: duplicate export

The two exported functions are truncated by the null byte resulting in a name collision when comparisons are done.

Expected results:

The module should of been instantiated without error and exported functions A\x00A and A\x00B.

More info

The way I read spec (found here) seems to indicate that Names are sequence of utf-8 characters. I think a null byte is a valid utf-8 characters. So the Name should not be truncated.

The function DecodeName found here seems to be responsible for the behavior. If null bytes are not allowed in utf8 strings then this function should return failure at this condition if (!IsUtf8(AsChars(Span(bytes, numBytes)))) { and generate an error about the bad Name.

Instead the code passes the IsUtf8 check and null terminates the string before returning it. It does not appear the length of the string is saved, so just treating it as a null terminated string will cause truncation behavior I observe.