Skip to content

map<K, V> allocates memory before validating the guest pointer #14810

Closed
#14835
Closed
map<K, V> allocates memory before validating the guest pointer#14810
#14835
Labels
wasm-proposal:component-model-mapIssues related to `map<K, V>`

Description

@alexcrichton
alexcrichton
opened on Oct 19, 2026

Currently lifting a map from a guest allocates memory based on the guest-supplied size, and then the size is validated to fit within fuel limits.

This means that the guest can control how much memory the host allocates, which is generally considered a DoS vector.

Activity

  1. alexcrichton
    added
    wasm-proposal:component-model-mapIssues related to `map<K, V>`
    on Oct 19, 2026
  2. jrandolf
    added 2 commits that reference this issue on Oct 20, 2026

    Validate map pointer/length before allocating when lifting

    6d66184

    Fuzz lifting lists and maps from arbitrary pointers and lengths

    205a311
  3. alexcrichton
    closed this as completedin #14835on Oct 20, 2026
  4. opensource-fork-sync
    added a commit that references this issue on Oct 20, 2026

    Validate map pointer/length before allocating when lifting (bytecodea…

    1befdc5
  5. jrandolf
    added a commit that references this issue on Oct 20, 2026

    Fuzz lifting lists and maps from arbitrary pointers and lengths

    0adebea
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    wasm-proposal:component-model-mapIssues related to `map<K, V>`

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions