[Security] Out-of-Bound Memory Read on "RemoveCodePageOfCapacity" Function

[mobsceneZ]

Environment

OS               : Linux 5.15.146.1-microsoft-standard-WSL2 #1 SMP Thu Jan 11 04:09:03 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
Commit           : 139076a98b8321b67f850a844f558b5e91b5ac83
Version          : 0.5.0
Clang Verison    : 13.0.0
Build            : mkdir -p build && cd build && export CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g" CXXFLAGS="-fsanitize=address -g" && cmake .. && make -j8
Affected Tool    : wasm3
Enabled Features : None
Impact           : Out-of-Bound Memory Read
Command          : wasm3/build/wasm3 --func main poc.wasm
Validation       : Invalid **(therefore possibly related to incomplete validation in wasm3)**

Proof of Concept

wasm3-poc-11.zip

Stack Trace Provide By AddressSanitizer

AddressSanitizer:DEADLYSIGNAL
=================================================================
==23649==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000030 (pc 0x0000005403c7 bp 0x000000000000 sp 0x7fff7fd8b580 T0)
==23649==The signal is caused by a READ memory access.
==23649==Hint: address points to the zero page.
    #0 0x5403c7 in RemoveCodePageOfCapacity /home/lain/wasm3/source/m3_env.c
    #1 0x5403c7 in Environment_AcquireCodePage /home/lain/wasm3/source/m3_env.c:142:12
    #2 0x5403c7 in AcquireCodePageWithCapacity /home/lain/wasm3/source/m3_env.c:1117:16
    #3 0x531bd8 in EnsureCodePageNumLines /home/lain/wasm3/source/m3_compile.c:34:28
    #4 0x52f1cd in EmitOp /home/lain/wasm3/source/m3_compile.c:68:18
    #5 0x532102 in CopyStackIndexToSlot /home/lain/wasm3/source/m3_compile.c:847:1
    #6 0x532102 in CopyStackTopToSlot /home/lain/wasm3/source/m3_compile.c:865:1
    #7 0x532102 in CompileCallArgsAndReturn /home/lain/wasm3/source/m3_compile.c:1637:1
    #8 0x50d5cf in Compile_Call /home/lain/wasm3/source/m3_compile.c:1670:1
    #9 0x529595 in CompileBlockStatements /home/lain/wasm3/source/m3_compile.c:2605:1
    #10 0x52ea92 in CompileFunction /home/lain/wasm3/source/m3_compile.c:2905:1
    #11 0x53c8d0 in m3_FindFunction /home/lain/wasm3/source/m3_env.c:748:1
    #12 0x4f9295 in repl_call /home/lain/wasm3/platforms/app/main.c:258:23
    #13 0x4fafe3 in main /home/lain/wasm3/platforms/app/main.c
    #14 0x7f3aa8427082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #15 0x41ea5d in _start (/home/lain/wasm3/build/wasm3+0x41ea5d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/lain/wasm3/source/m3_env.c in RemoveCodePageOfCapacity
==23649==ABORTING