mirror of
https://github.com/fluencelabs/wasm-bindgen
synced 2025-06-16 14:31:22 +00:00
Prevent use-after-free with vectors
Awhile back slices switched to being raw views into wasm memory, but this doens't work if we free the underlying memory unconditionally! Moving around a `Vec` is already moving a lot of data, so let's copy it onto the JS heap instead of leaving it in the wasm heap.
This commit is contained in:
@ -256,7 +256,7 @@ impl<'a, 'b> Js2Rust<'a, 'b> {
|
||||
const mem = getUint32Memory();\n\
|
||||
const ptr = mem[retptr / 4];\n\
|
||||
const len = mem[retptr / 4 + 1];\n\
|
||||
const realRet = {}(ptr, len);\n\
|
||||
const realRet = {}(ptr, len).slice();\n\
|
||||
wasm.__wbindgen_free(ptr, len * {});\n\
|
||||
return realRet;\n\
|
||||
", f, ty.size());
|
||||
|
@ -90,6 +90,7 @@ impl<'a, 'b> Rust2Js<'a, 'b> {
|
||||
|
||||
if !arg.is_by_ref() {
|
||||
self.prelude(&format!("\
|
||||
v{0} = v{0}.slice();\n\
|
||||
wasm.__wbindgen_free({0}, {1} * {size});\
|
||||
", abi, abi2, size = ty.size()));
|
||||
self.cx.require_internal_export("__wbindgen_free")?;
|
||||
|
Reference in New Issue
Block a user