CABI: trap on misaligned error-context.debug-message ptr (#740)

canon_error_context_debug_message stored the debug string's (pointer,
length) pair at the guest-supplied `ptr` with store_string, which writes
through store_int without any alignment or bounds check. A misaligned `ptr`
was thus accepted, and an out-of-bounds `ptr` silently grew the Python
bytearray backing linear memory (appending at its current end) instead of
trapping.

Check `ptr` the same way lower_flat_values checks an out-param pointer
before storing a spilled tuple: trap unless `ptr` is aligned to
alignment(string) and `ptr + elem_size(string)` is within memory, then go
through store, whose assertions these checks discharge. The checks run
before opts.realloc is called.

Assisted-by: claude:claude-opus-5-5

Author: rvolosatovs

design/mvp/CanonicalABI.md

@@ -4832,12 +4832,17 @@ def canon_error_context_debug_message(opts, i, ptr):
   errctx = inst.handles.get(i)
   trap_if(not isinstance(errctx, ErrorContext))
   cx = LiftLowerContext(opts, inst)
-  store_string(cx, errctx.debug_message, ptr)
+  trap_if(ptr != align_to(ptr, alignment(StringType(), cx.opts.memory.ptr_type())))
+  trap_if(ptr + elem_size(StringType(), cx.opts.memory.ptr_type()) > len(cx.opts.memory))
+  store(cx, errctx.debug_message, StringType(), ptr)
   return []
 ```
 Note that `ptr` points to a region of memory (8 bytes for memory32, 16 bytes
 for memory64) into which will be stored the pointer and length of the debug
-string (allocated via `opts.realloc`).
+string (allocated via `opts.realloc`). As with any `string` stored in linear
+memory, `ptr` must be aligned to the pointer size (4 bytes for memory32, 8 bytes
+for memory64) and the whole region must be in bounds, which is checked
+(trapping otherwise) before `opts.realloc` is called.
 
 
 ### 📝 `canon error-context.drop`

design/mvp/Explainer.md

@@ -2399,7 +2399,8 @@ The `error-context.debug-message` built-in returns the
 
 In the Canonical ABI, it writes the debug message into `ptr` as an 8-byte or
 16-byte (`ptr`, `length`) pair, according to the Canonical ABI for `string`,
-given the `<canonopt>*` immediates.
+given the `<canonopt>*` immediates, trapping if `ptr` is misaligned or out of
+bounds.
 
 For details, see [`canon_error_context_debug_message`] in the Canonical ABI
 explainer.

design/mvp/canonical-abi/definitions.py

@@ -2664,7 +2664,9 @@ def canon_error_context_debug_message(opts, i, ptr):
   errctx = inst.handles.get(i)
   trap_if(not isinstance(errctx, ErrorContext))
   cx = LiftLowerContext(opts, inst)
-  store_string(cx, errctx.debug_message, ptr)
+  trap_if(ptr != align_to(ptr, alignment(StringType(), cx.opts.memory.ptr_type())))
+  trap_if(ptr + elem_size(StringType(), cx.opts.memory.ptr_type()) > len(cx.opts.memory))
+  store(cx, errctx.debug_message, StringType(), ptr)
   return []
 
 ### 📝 `canon error-context.drop`