diff --git a/Libraries/LibWasm/AbstractMachine/BytecodeInterpreter.cpp b/Libraries/LibWasm/AbstractMachine/BytecodeInterpreter.cpp index a1de59e51a8..6d2bc0d8605 100644 --- a/Libraries/LibWasm/AbstractMachine/BytecodeInterpreter.cpp +++ b/Libraries/LibWasm/AbstractMachine/BytecodeInterpreter.cpp @@ -469,13 +469,16 @@ void BytecodeInterpreter::interpret_impl(Configuration& configuration, Expressio u8 value = static_cast(configuration.take_source(1, addresses.sources).to()); auto destination_offset = configuration.take_source(2, addresses.sources).to(); - TRAP_IN_LOOP_IF_NOT(static_cast(destination_offset + count) <= instance->data().size()); + Checked checked_end = destination_offset; + checked_end += count; + TRAP_IN_LOOP_IF_NOT(!checked_end.has_overflow() && static_cast(checked_end.value()) <= instance->data().size()); if (count == 0) RUN_NEXT_INSTRUCTION(); + Instruction::MemoryArgument memarg { 0, 0, args.memory_index }; for (u32 i = 0; i < count; ++i) { - if (store_to_memory(configuration, Instruction::MemoryArgument { 0, 0 }, { &value, sizeof(value) }, destination_offset + i)) + if (store_to_memory(configuration, memarg, { &value, sizeof(value) }, destination_offset + i)) return; } diff --git a/Libraries/LibWasm/Tests/Executor/test-memfill-memidx.js b/Libraries/LibWasm/Tests/Executor/test-memfill-memidx.js new file mode 100644 index 00000000000..c33a14b458c --- /dev/null +++ b/Libraries/LibWasm/Tests/Executor/test-memfill-memidx.js @@ -0,0 +1,11 @@ +test("memfill executes and returns expected result", () => { + const bin = readBinaryWasmFile("Fixtures/Modules/memfill-memidx.wasm"); + + const module = parseWebAssemblyModule(bin); + + const go = module.getExport("go"); + const result = module.invoke(go); + + // mem1[0]=0xAA, mem0[0]=0x00 → 0xAA00 = 43520 + expect(result).toBe(43520); +}); diff --git a/Libraries/LibWasm/Tests/Fixtures/Modules/memfill-memidx.wasm b/Libraries/LibWasm/Tests/Fixtures/Modules/memfill-memidx.wasm new file mode 100644 index 00000000000..faed7b14b86 Binary files /dev/null and b/Libraries/LibWasm/Tests/Fixtures/Modules/memfill-memidx.wasm differ