andoma / vmir

Virtual Machine for Intermediate Representation

VMIR - Virtual Machine for Intermediate Representation

VMIR is a standalone library written in C that can parse and execute:

• WebAssembly .wasm files
• LLVM Bitcode .bc files

Optionally it can generate machine code (JIT) to speed up execution significantly. JIT is currently only supported on 32 bit ARM.

VMIR is licensed under the MIT license. See LICENSE.

To build VMIR just type:

$ make

... and you will end up with a VMIR binary in very same directory. The library is compiled from a single file src/vmir.c which in turn include other files to keep the code somewhat separated.

Example

Let's create a small program and run it. Type the following well known snippet into a file called helloworld.c

int main(void)
{
  printf("Hello world\n");
  return 0;
}

Then compile it

clang -emit-llvm -target le32-unknown-nacl -c helloworld.c -o helloworld.bc

And finally, run it:

$ ./vmir helloworld.bc
Hello world

Compiling to WebAssembly requires a bit more work than a single line. However, there is a pre-built version of sha1sum included in the source repo.

$ echo hello | ./vmir examples/prebuilt/sha1sum.wasm
f572d396fae9206628714fb2ce00f72e94f2258f  -

If you're on Linux and want to go all crazy you can use VMIR to execute Bitcode and WebAssembly directly from the command line by installing a kernel binfmt pointing to the VMIR executable:

echo ":vmirwasm:M::\x00\x61\x73\x6d\x01::${PWD}/vmir:" | sudo tee /proc/sys/fs/binfmt_misc/register
echo ":vmirbc:M::\x42\x43\xc0\xde::${PWD}/vmir:" | sudo tee /proc/sys/fs/binfmt_misc/register

And then you just simply just do:

$ echo hello | examples/prebuilt/sha1sum.wasm
f572d396fae9206628714fb2ce00f72e94f2258f  -

Performance

Interpretation is about 10x slower (on x86) than the same binary compiled as native code. Still it's a lot faster than LLVM's own interpreter (which by all means is not intended to run code fast in any way)

Example run of test/misc/src/sha1test.c over 64MB of random data

Environment	(Core i7 3.2GHz)	ARMv7 BCM2709 (Rpi2)
Native	0.39s	3.54s
VMIR JIT	n/a	17.5s
VMIR	4.8s	1m 42s
LLVM LLI	7m 39s	n/a

Status

VMIR currently passes the gcc torture test suite on optimization level 0, 1 and 2. Those tests can be found in test/gcc-torture. Use make && ./runtest to run the tests.

Missing features, known bugs

• The built-in libc is lacking a lot of functions and features. This is where most work needs to be done.
• No support for vector types (Ie, code must be compiled with -fno-vectorize -fno-slp-vectorize).
• Not all instructions classes / value types are JITed.
• No C++ STL solution. Ideas welcome...

Compiling C/C++ to Bitcode

VMIR uses the same target as Google NativeClient. There are small examples in test/misc.

When building bigger projects consisting of multiple files you must llvm-link to combine the .bc files into a single file.

Compiling C/C++ to WebAssembly

Building for WebAssembly is a bit more involved atm. There is a document here: docs/wasm.md, that shows how to setup LLVM + Binaryen and the WebAssembly Binary Toolkit. Once you have that in place there are some small examples in examples/wasm that could get you started.

Embedding VMIR

Including VMIR in your own project is pretty straight forward. Just copy the files from src/ to your project but only compile vmir.c (it will include all other .c -files on its own). The API is defined in vmir.h. See src/main.c for example how to load and execute binaries.

VMIR's libc also offers an option to use TLSF for memory allocation. The default built-in allocator is a very simple linear search first-fit algorithm.

Wait? Wut? Why?

You might ask yourself what the purpose of VMIR actually is and why it even exists?

As with many of these kind of project I just wanted to scratch and itch but also be able to ship plugins written in C and C++ for another project of mine.

Now with the rise of WebAssembly I intend to focus more on that as the primary input to VMIR mostly because it's more stable than LLVM's Bitcode, which is not really meant to be used as a shippable object code.

Given enough time I also hope to improve the JIT engine to be able to emit code for more architectures (In particular ARMv8 and x86_64).

Follow me on https://twitter.com/andoma

vmir's Issues

stack-overflow in init_local_vars

version

e81176b

compile

make vmir.asan

asan report

root@9dc6ce043bcb:~/Ablation/vmir/crashes# ../vmir.asan id:000033,sig:11,src:000006,op:int32,pos:21,val:-32768
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4108692==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd7aa6bb18 (pc 0x55b5a74e06c0 bp 0x7ffd7b269bc0 sp 0x7ffd7aa6ab20 T0)
    #0 0x55b5a74e06bf in init_local_vars src/vmir_wasm_parser.c:517
    #1 0x55b5a74e49ac in wasm_parse_section_code src/vmir_wasm_parser.c:1251
    #2 0x55b5a74e69b3 in wasm_parse_module src/vmir_wasm_parser.c:1422
    #3 0x55b5a74e91a0 in vmir_load src/vmir.c:920
    #4 0x55b5a74509c9 in main src/main.c:166
    #5 0x7f469dbfc082 in __libc_start_main ../csu/libc-start.c:308
    #6 0x55b5a744fd2d in _start (/root/Ablation/vmir/vmir.asan+0x12d2d)

SUMMARY: AddressSanitizer: stack-overflow src/vmir_wasm_parser.c:517 in init_local_vars
==4108692==ABORTING

reproduce

./vmir https://github.com/haruki3hhh/fuzzing/blob/main/vmir/id%3A000033%2Csig%3A11%2Csrc%3A000006%2Cop%3Aint32%2Cpos%3A21%2Cval%3A-32768

Evil Memory Adress Read in export_function

version

e81176b

compile

make vmir.asan

asan report

root@9dc6ce043bcb:~/Ablation/vmir/crashes# ../vmir.asan id:000008,sig:11,src:000000,op:int32,pos:13,val:+64
Declared memory size:2
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4108488==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x562ea34af6f3 bp 0x7fff471067d0 sp 0x7fff471067a0 T0)
==4108488==The signal is caused by a READ memory access.
==4108488==Hint: address points to the zero page.
    #0 0x562ea34af6f2 in export_function src/vmir_wasm_parser.c:394
    #1 0x562ea34af7c3 in wasm_parse_section_exports src/vmir_wasm_parser.c:411
    #2 0x562ea34b699b in wasm_parse_module src/vmir_wasm_parser.c:1419
    #3 0x562ea34b91a0 in vmir_load src/vmir.c:920
    #4 0x562ea34209c9 in main src/main.c:166
    #5 0x7fb601ab4082 in __libc_start_main ../csu/libc-start.c:308
    #6 0x562ea341fd2d in _start (/root/Ablation/vmir/vmir.asan+0x12d2d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV src/vmir_wasm_parser.c:394 in export_function
==4108488==ABORTING

reproduce

./vmir https://github.com/haruki3hhh/fuzzing/blob/main/vmir/id%3A000008%2Csig%3A11%2Csrc%3A000000%2Cop%3Aint32%2Cpos%3A13%2Cval%3A%2B64

emscripten

Does anything prevent compiling this with emscripten?

Question about Indirect Call with Specified Address

Hello:
Since vmir is such a efficient interpreter for bitcode, I decide to fix it for daily use(I work for Android/IOS code protection). After I fixed some function in Linker such as dlopen & dlsym, it seems to have a logic error about VMOP(JSR_R). Once I use dlopen&dlsym to get a function address and try to call it, the interpreter can not call this indirect function by using the specified address. I tried to fix this problem with the code below.

VMOP(JSR_R)
vm_tracef(&F, "Calling indirect %s (%d)", vm_funcname(R32(0), iu), R32(0));
if (R32(0) >= VECTOR_LEN(&iu->iu_functions))
{
	printf("[-] JSR_R out of length: 0x%08x\n", R32(0));
	vm_bad_function(iu, R32(0));
}

SET_CALLEE_FUNC(R32(0));
if (iu->iu_vm_funcs[R32(0)])
{
	r = vm_exec(iu->iu_vm_funcs[R32(0)], rf + I[1], rf + I[2], &F);
	RESTORE_CURRENT_FRAME();
	if (r)
		return r;
}
else if (iu->iu_function_table[R32(0)])
{
	iu->iu_function_table[R32(0)](rf + I[2], rf + I[1], iu, hostmem);
	RESTORE_CURRENT_FRAME();
}
else if ((int32_t)R32(0) + iu->iu_mem > 0x10000000) // bad, how to locate a func ptr
{
	// (rf + I[0]) func_addr
	void *params = rf + I[1];
	printf("\n----------[JSR_R] args: %08x  %08x %08x\n", vmir_vm_ptr(&params, iu), vmir_vm_ptr(&params, iu), vmir_vm_ptr(&params, iu));
	typedef int (*indirect_func)(int, ...);
	void *func_addr = R32(0) + iu->iu_mem;
	// TODO: args
}
else	
{
	vm_bad_function(iu, R32(0));
}

I found that R32(0) is address in vm_mem and rf + I[1] locate on the params, but I can not find a way to figure out how many params the indirect function use, any advice, please.

Completion of error handling

Would you like to add more error handling for return values from functions like the following?

• calloc ⇒ vmir_create
• strdup ⇒ value_symtab_rec_handler

String length too long

Steps to reproduce the issue:

• Visit this page: https://tbfleming.github.io/cib/
• Click "compile"
• Click "save*

Run the saved user.wasm file with vmir:

$ vmir user.wasm
Parser error: src/vmir_wasm_parser.c:167 : String length too long

heap-buffer-overflow Read in wasm_call

version

e81176b

compile

make vmir.asan

asan report

root@9dc6ce043bcb:~/Ablation/vmir/crashes# ../vmir.asan id:000029,sig:11,src:000006,op:int8,pos:25,val:+16
=================================================================
==4108641==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000000a8 at pc 0x55ef41d18cbe bp 0x7fff4e146b40 sp 0x7fff4e146b30
READ of size 8 at 0x6020000000a8 thread T0
    #0 0x55ef41d18cbd in wasm_call src/vmir_wasm_parser.c:924
    #1 0x55ef41d1a211 in wasm_parse_block src/vmir_wasm_parser.c:1166
    #2 0x55ef41d1aa32 in wasm_parse_section_code src/vmir_wasm_parser.c:1257
    #3 0x55ef41d1c9b3 in wasm_parse_module src/vmir_wasm_parser.c:1422
    #4 0x55ef41d1f1a0 in vmir_load src/vmir.c:920
    #5 0x55ef41c869c9 in main src/main.c:166
    #6 0x7fcc9f474082 in __libc_start_main ../csu/libc-start.c:308
    #7 0x55ef41c85d2d in _start (/root/Ablation/vmir/vmir.asan+0x12d2d)

0x6020000000a8 is located 8 bytes to the left of 11-byte region [0x6020000000b0,0x6020000000bb)
allocated by thread T0 here:
    #0 0x7fcc9f8273ed in __interceptor_strdup ../../../../src/libsanitizer/asan/asan_interceptors.cc:445
    #1 0x55ef41c96704 in bb_add_named src/vmir_function.c:48
    #2 0x55ef41d19af0 in wasm_parse_block src/vmir_wasm_parser.c:1084
    #3 0x55ef41d1aa32 in wasm_parse_section_code src/vmir_wasm_parser.c:1257
    #4 0x55ef41d1c9b3 in wasm_parse_module src/vmir_wasm_parser.c:1422
    #5 0x55ef41d1f1a0 in vmir_load src/vmir.c:920
    #6 0x55ef41c869c9 in main src/main.c:166
    #7 0x7fcc9f474082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow src/vmir_wasm_parser.c:924 in wasm_call

reproduce

./vmir https://github.com/haruki3hhh/fuzzing/blob/main/vmir/id%3A000029%2Csig%3A11%2Csrc%3A000006%2Cop%3Aint8%2Cpos%3A25%2Cval%3A%2B16

Null Pointer Deref in wasm_parse_block

version

e81176b

compile

make vmir.asan

asan report

root@9dc6ce043bcb:~/Ablation/vmir/crashes# ../vmir.asan id:000023,sig:11,src:000006,op:arith8,pos:23,val:-30
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4108594==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x560771ea04b1 bp 0x7fffa6d7d340 sp 0x7fffa6d7d260 T0)
==4108594==The signal is caused by a READ memory access.
==4108594==Hint: address points to the zero page.
    #0 0x560771ea04b0 in wasm_parse_block src/vmir_wasm_parser.c:1190
    #1 0x560771ea0a32 in wasm_parse_section_code src/vmir_wasm_parser.c:1257
    #2 0x560771ea29b3 in wasm_parse_module src/vmir_wasm_parser.c:1422
    #3 0x560771ea51a0 in vmir_load src/vmir.c:920
    #4 0x560771e0c9c9 in main src/main.c:166
    #5 0x7f28a34ed082 in __libc_start_main ../csu/libc-start.c:308
    #6 0x560771e0bd2d in _start (/root/Ablation/vmir/vmir.asan+0x12d2d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV src/vmir_wasm_parser.c:1190 in wasm_parse_block
==4108594==ABORTING

reproduce

./vmir https://github.com/haruki3hhh/fuzzing/blob/main/vmir/id%3A000023%2Csig%3A11%2Csrc%3A000006%2Cop%3Aarith8%2Cpos%3A23%2Cval%3A-30

study as a beginner

As a beginner,I am so confused about the logic of your code! Can you give me some advices? Thank you very much!

Can't handle opcode 0x23

When checking out the latest commit of the Go compiler and building a simple "hello world" program with:

GOARCH=wasm GOOS=js go build

And then running it with vmir, I get the following error:

Skipping named section go.buildid
Can't handle opcode 0x23

Dump of faildump function (null) (i32 (*)())
.0: "Preamble"
         (i64)%0 = move (i64)%32#0x0
         (i64)%1 = move (i64)%33#0x0
         (i64)%2 = move (i64)%34#0x0
         (i64)%3 = move (i64)%35#0x0
         (i64)%4 = move (i64)%36#0x0
         (i64)%5 = move (i64)%37#0x0
         (i64)%6 = move (i64)%38#0x0
         (i64)%7 = move (i64)%39#0x0
         (i64)%8 = move (i64)%40#0x0
         (i64)%9 = move (i64)%41#0x0
         (i64)%10 = move (i64)%42#0x0
         (i64)%11 = move (i64)%43#0x0
         (i64)%12 = move (i64)%44#0x0
         (i64)%13 = move (i64)%45#0x0
         (i64)%14 = move (i64)%46#0x0
         (i64)%15 = move (i64)%47#0x0
         (double)%16 = move (double)%48#0.000000
         (double)%17 = move (double)%49#0.000000
         (double)%18 = move (double)%50#0.000000
         (double)%19 = move (double)%51#0.000000
         (double)%20 = move (double)%52#0.000000
         (double)%21 = move (double)%53#0.000000
         (double)%22 = move (double)%54#0.000000
         (double)%23 = move (double)%55#0.000000
         (double)%24 = move (double)%56#0.000000
         (double)%25 = move (double)%57#0.000000
         (double)%26 = move (double)%58#0.000000
         (double)%27 = move (double)%59#0.000000
         (double)%28 = move (double)%60#0.000000
         (double)%29 = move (double)%61#0.000000
         (double)%30 = move (double)%62#0.000000
         (double)%31 = move (double)%63#0.000000
         b .1

.1: "Func block"
         b .3

.3: "Loop start"

.10: "Block exit"

.9: "Block exit"

.8: "Block exit"

.7: "Block exit"

.6: "Block exit"

.5: "Block exit"

.4: "Block exit"

.2: "Block exit"

Here's the "hello world" program, main.go:

package main

import "fmt"

func main() {
        fmt.Println("Hello, World!")
}

Not working with clang 3.9

Hello !
I'm testing vmir with clang 3.8 and with 3.9 it gives this error after fixing some missing bitcodes:

Parser error: src/vmir_bitcode_parser.c:978 : Can't handle abbrevs with arg 5 yet

Missing bitcodes:

#if defined(VMIR_LLVM_38) || defined(VMIR_LLVM_39)
#define MODULE_CODE_ALIAS      14
#else
#define MODULE_CODE_ALIAS      9
#endif
...
//VMIR_LLVM_39
#define MODULE_CODE_SOURCE_FILENAME 16
#define MODULE_CODE_HASH 17
#define MODULE_CODE_IFUNC 18

Evil Memory Read in import_function

version

e81176b

compile

make vmir.asan

asan report

root@9dc6ce043bcb:~/Ablation/vmir/crashes# ../vmir.asan id:000010,sig:11,src:000000,op:havoc,rep:2
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4108536==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55f249e29d41 bp 0x7ffe007128c0 sp 0x7ffe00712880 T0)
==4108536==The signal is caused by a READ memory access.
==4108536==Hint: address points to the zero page.
    #0 0x55f249e29d40 in import_function src/vmir_wasm_parser.c:246
    #1 0x55f249e2a43d in wasm_parse_section_import_decl src/vmir_wasm_parser.c:325
    #2 0x55f249e31917 in wasm_parse_module src/vmir_wasm_parser.c:1404
    #3 0x55f249e341a0 in vmir_load src/vmir.c:920
    #4 0x55f249d9b9c9 in main src/main.c:166
    #5 0x7fc70dbe6082 in __libc_start_main ../csu/libc-start.c:308
    #6 0x55f249d9ad2d in _start (/root/Ablation/vmir/vmir.asan+0x12d2d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV src/vmir_wasm_parser.c:246 in import_function
==4108536==ABORTING

reproduce

./vmir https://github.com/haruki3hhh/fuzzing/blob/main/vmir/id%3A000010%2Csig%3A11%2Csrc%3A000000%2Cop%3Ahavoc%2Crep%3A2

Idea: Auto generate libc wrappers

Just an idea, not an issue. Most libc routine implementations in VMIR look like they're trivial wrappers around their original. You could generate these wrappers from a libc like ulibc, musl libc, diet libc.

Only builds with clang, fails to build with gcc

When building with clang, it works:

$ CC=clang make
clang -O2 -std=gnu99 -Wall -Werror -Wmissing-prototypes -I/home/afr/clones/vmir -DVMIR_USE_TLSF -I/home/afr/clones/vmir/tlsf -g src/main.c src/vmir.c tlsf/tlsf.c  -lm -o vmir

But with gcc, I get errors:

cc -O2 -std=gnu99 -Wall -Werror -Wmissing-prototypes -I/home/afr/clones/vmir -DVMIR_USE_TLSF -I/home/afr/clones/vmir/tlsf -g src/main.c src/vmir.c tlsf/tlsf.c  -lm -o vmir
In file included from src/vmir.c:595:
src/vmir_vm.c: In function ‘vm_exec’:
src/vmir_vm.c:1635:7: error: ‘strncat’ accessing between 1 and 4294967295 bytes at offsets [0, 4294967295] and [0, 4294967295] may overlap 1 byte at offset [0, 8589934590] [-Werror=restrict]
       strncat(HOSTADDR(R32(1)), HOSTADDR(R32(2)), R32(3));
       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vmir_vm.c:1628:7: error: ‘strncpy’ accessing between 0 and 4294967295 bytes at offsets [0, 4294967295] and [0, 4294967295] may overlap up to 4294967295 bytes at offset 4294967294 [-Werror=restrict]
       strncpy(HOSTADDR(R32(1)), HOSTADDR(R32(2)), R32(3));
       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vmir_vm.c:1621:7: error: ‘strcat’ accessing 1 or more bytes at offsets [0, 4294967295] and [0, 4294967295] may overlap 1 byte at offset [0, 9223372036854775807] [-Werror=restrict]
       strcat(HOSTADDR(R32(1)), HOSTADDR(R32(2)));
       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vmir_vm.c:1614:7: error: ‘strcpy’ accessing 1 byte at offsets [0, 4294967295] and [0, 4294967295] may overlap 1 byte at offset 0 [-Werror=restrict]
       strcpy(HOSTADDR(R32(1)), HOSTADDR(R32(2)));
       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make: *** [Makefile:29: vmir] Error 1

GCC version:

$ cc --version
cc (GCC) 8.1.1 20180531
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Clang version:

$ clang --version
clang version 6.0.1 (tags/RELEASE_601/final)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin

This is on 64-bit Arch Linux.

Bytecode generated with current clang doesn't seem to work anymore

The builds with clang from ubuntu xenial run just fine but the ones generated with ubuntu bionic clang fails with Parser error: src/vmir_type.c:139 : Type (i8) (index:0) is not a pointer

I am trying to build the simple hello world example from the readme.

helloworld_working.bc.zip
helloworld_broken.bc.zip

Evil Memory Address Write in function_prepare_parse

version

e81176b

compile

make vmir.asan

asan report

root@9dc6ce043bcb:~/Ablation/vmir/crashes# ../vmir.asan  id:000005,sig:11,src:000000,op:arith8,pos:8,val:+9
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4108439==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000024 (pc 0x55e2684c62d8 bp 0x7ffc1f605ec0 sp 0x7ffc1f605ea0 T0)
==4108439==The signal is caused by a WRITE memory access.
==4108439==Hint: address points to the zero page.
    #0 0x55e2684c62d7 in function_prepare_parse src/vmir_function.c:145
    #1 0x55e2685498b9 in wasm_parse_section_code src/vmir_wasm_parser.c:1243
    #2 0x55e26854b9b3 in wasm_parse_module src/vmir_wasm_parser.c:1422
    #3 0x55e26854e1a0 in vmir_load src/vmir.c:920
    #4 0x55e2684b59c9 in main src/main.c:166
    #5 0x7ffa7c5e4082 in __libc_start_main ../csu/libc-start.c:308
    #6 0x55e2684b4d2d in _start (/root/Ablation/vmir/vmir.asan+0x12d2d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV src/vmir_function.c:145 in function_prepare_parse
==4108439==ABORTING

reproduce

./vmir https://github.com/haruki3hhh/fuzzing/blob/main/vmir/id%3A000005%2Csig%3A11%2Csrc%3A000000%2Cop%3Aarith8%2Cpos%3A8%2Cval%3A%2B9

Add the ability to build on OS X

The project cannot be built on OS X currently.

You get the following errors:

cc -O2 -std=gnu99 -Wall -Werror -Wmissing-prototypes -Ivmir -DVMIR_USE_TLSF -Ivmir/tlsf -g src/main.c src/vmir.c tlsf/tlsf.c  -lm -o vmir
In file included from src/vmir.c:526:
src/vmir_libc.c:463:23: error: unknown type name 'off64_t'; did you mean 'off_t'?
cookie_seek(void *fh, off64_t *offsetp, int whence)
                      ^~~~~~~
                      off_t
/usr/include/sys/_types/_off_t.h:30:25: note: 'off_t' declared here
typedef __darwin_off_t          off_t;
                                ^
In file included from src/vmir.c:526:
src/vmir_libc.c:484:14: error: unknown type name 'cookie_io_functions_t'
static const cookie_io_functions_t cookiefuncs = {
             ^
src/vmir_libc.c:541:15: error: implicit declaration of function 'fopencookie' is invalid in C99 [-Werror,-Wimplicit-function-declaration]
  vfile->fp = fopencookie(vfile, mode, cookiefuncs);
              ^
3 errors generated.

Null pointer deref in wasm_parse_section_functions

version

e81176b

compile

make vmir.asan

asan report

root@9dc6ce043bcb:~/Ablation/vmir/crashes# ../vmir.asan id\:000000\,sig\:11\,src\:000000\,op\:flip1\,pos\:8 
Skipping section type 65
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4108360==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55c67e5638d7 bp 0x7fffcb46f890 sp 0x7fffcb46f850 T0)
==4108360==The signal is caused by a READ memory access.
==4108360==Hint: address points to the zero page.
    #0 0x55c67e5638d6 in wasm_parse_section_functions src/vmir_wasm_parser.c:432
    #1 0x55c67e56a932 in wasm_parse_module src/vmir_wasm_parser.c:1407
    #2 0x55c67e56d1a0 in vmir_load src/vmir.c:920
    #3 0x55c67e4d49c9 in main src/main.c:166
    #4 0x7f055f86c082 in __libc_start_main ../csu/libc-start.c:308
    #5 0x55c67e4d3d2d in _start (/root/Ablation/vmir/vmir.asan+0x12d2d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV src/vmir_wasm_parser.c:432 in wasm_parse_section_functions
==4108360==ABORTING

reproduce

./vmir PoC

s2wasm no longer a thing

It was removed from binaryen but is still needed by the examples. WebAssembly/binaryen#1607