diff --git a/crates/wasmparser/src/validator/operators.rs b/crates/wasmparser/src/validator/operators.rs index 249bc070d9..345ac1f644 100644 --- a/crates/wasmparser/src/validator/operators.rs +++ b/crates/wasmparser/src/validator/operators.rs @@ -931,6 +931,14 @@ where /// breaks interact with this block's type. Additionally the type signature /// of the block is specified by `ty`. fn push_ctrl(&mut self, kind: FrameKind, ty: BlockType) -> Result<()> { + // If the control stack is already empty then that means that the + // function has already ended and it's invalid to have operators. + // Prevent pushing more frames to the control stack and immediately + // return an error. + if self.control.is_empty() { + return Err(self.err_beyond_end(self.offset)); + } + // Push a new frame which has a snapshot of the height of the current // operand stack. let height = self.operands.len(); diff --git a/tests/cli/block-after-frame.wat b/tests/cli/block-after-frame.wat new file mode 100644 index 0000000000..fe052313f4 --- /dev/null +++ b/tests/cli/block-after-frame.wat @@ -0,0 +1,16 @@ +;; FAIL: validate % + +(module + (func (param i32) (result i32) + i32.const 0 + i32.const 0 + br_if 0 + i32.const 0 + return + end + block + i32.const 0 + return + end + ) +) diff --git a/tests/cli/block-after-frame.wat.stderr b/tests/cli/block-after-frame.wat.stderr new file mode 100644 index 0000000000..9ea54b6c87 --- /dev/null +++ b/tests/cli/block-after-frame.wat.stderr @@ -0,0 +1,4 @@ +error: func 0 failed to validate + +Caused by: + 0: operators remaining after end of function (at offset 0x23)