fix: enforce limits on initial memory allocation, cleanup memory instance

Signed-off-by: Henry <mail@henrygressmann.de>

Author: explodingcamera

ARCHITECTURE.md

@@ -46,7 +46,7 @@ Linear memory is a contiguous `Vec<u8>` allocation owned by a `MemoryInstance`.
 
 Fixed-width loads and stores use a single const-generic `read_fixed::<N>` / `write_fixed::<N>` pair rather than per-width vtable methods. Scalar operations reduce to an effective-address computation, a bounds check, a slice access, and a `from_le_bytes` / `to_le_bytes` conversion, with out-of-bounds construction kept on cold paths. Bulk operations such as `fill` and `copy_within` map directly to native slice methods.
 
-Memory growth keeps the Wasm page count and limits on `MemoryInstance`. Before the backing allocation is resized, the configured `ResourceLimiter` is consulted so a host can bound guest memory consumption. The limiter is shared across the stores created from one `Engine` and lives behind an `Arc`.
+Memory growth keeps the Wasm page count and limits on `MemoryInstance`. Before the backing storage is allocated or resized, the configured `ResourceLimiter` is consulted so a host can bound guest memory consumption. The limiter is shared across the stores created from one `Engine` and lives behind an `Arc`.
 
 For conventional operating systems, a future mmap-backed storage could reserve virtual address space and use guard pages to move more bounds enforcement to the operating system, reducing explicit checks in linear-memory hot paths. This is the same broad approach described in [Wasmtime's linear-memory architecture](https://docs.wasmtime.dev/contributing-architecture.html#linear-memory), where virtual-memory reservations and guard regions eliminate or deduplicate explicit bounds checks.
 

CHANGELOG.md

@@ -17,7 +17,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Added `ValueLane` for mapping WebAssembly value types to their physical 32-bit, 64-bit, or 128-bit storage lane.
 - Added a `validate` feature to `tinywasm` and `tinywasm-parser` (enabled by default) to optionally skip wasmparser validation for faster parsing of trusted modules.
 - Added optional parse-time operand deduplication to reduce precompiled module and `.twasm` archive size.
-- Added a `ResourceLimiter` trait, configurable through `engine::Config::with_resource_limiter`, to bound guest memory growth.
+- Added a `ResourceLimiter` trait, configurable through `engine::Config::with_resource_limiter`, to bound guest memory allocation and growth.
 
 ### Changed
 
@@ -27,13 +27,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Module types now use one dense recursive type space, while function types are resolved through `Function::ty(&Store)`.
 - Globals are stored in separate 32-bit, 64-bit, and 128-bit value lanes, avoiding tagged value conversion during guest execution.
 - Linear memory now uses a single contiguous `Vec`-backed storage with const-generic fixed-width loads and stores.
+- Increased the minimum supported Rust version from 1.95 to 1.98.
 
 ### Fixed
 
 - Directly defined imports now reject handles from a different `Store`.
 - Tail calls to host functions now return directly to the caller frame.
 - Fixed Memory64 bulk-memory operations and optimized stores using the wrong value-stack lane.
-- Fixed `memory.init` bounds checks, operand lowering, and local-memory allocation analysis.
+- Fixed `memory.init` bounds checks and operand lowering.
 - Fixed Memory64 default limits and host-size handling, including 32-bit targets.
 
 ### Breaking Changes
@@ -45,7 +46,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Renamed `ModuleInstanceAddr` to `ModuleInstanceId`.
 - Removed `HostFunction::ty` and `WasmFunction::ty`. Use `Function::ty(&Store)` for runtime function types.
 - Changed `TableType::element_type` and `Element::ty` from `WasmType` to `RefType`, and replaced module `table_types` with `TableDefinition { ty, init }`.
-- Removed the pluggable memory backend system (`LinearMemory`, `MemoryBackend`, `VecMemory`, `PagedMemory`, `LazyLinearMemory`, and `Config::with_memory_backend`). Linear memory is always `Vec`-backed.
+- Removed the pluggable memory backend system (`LinearMemory`, `MemoryBackend`, `VecMemory`, `PagedMemory`, `LazyLinearMemory`, and `Config::with_memory_backend`). Linear memory is always `Vec`-backed. To limit initial memory allocation and growth, configure a `ResourceLimiter` with `Config::with_resource_limiter`.
 - Removed the local-memory allocation analysis (`LocalMemoryAllocation` and `ParserOptions::optimize_local_memory_allocation`). Local memories are always allocated eagerly.
 
 ## [0.10.0] - 2026-07-24

README.md

@@ -61,7 +61,7 @@ TinyWasm modules can be compiled to the internal `twasm` bytecode format, which
 
 With default features disabled, `tinywasm` depends only on `core`, `alloc`, and `libm`[^libm], making it usable in `no_std + alloc` environments.
 
-Use `Engine` and `engine::Config` when you need non-default runtime settings such as fuel accounting, stack sizing, the GC collection threshold, or trap-on-OOM behavior. A `ResourceLimiter` attached to the engine's config bounds guest memory growth.
+Use `Engine` and `engine::Config` when you need non-default runtime settings such as fuel accounting, stack sizing, the GC collection threshold, or trap-on-OOM behavior. A `ResourceLimiter` attached to the engine's config bounds guest memory allocation and growth.
 
 [^libm]: [rust-lang/rust#137578](https://github.com/rust-lang/rust/issues/137578) — tracking issue for floating-point math support in `no_std`.
 

crates/parser/src/conversion.rs

@@ -151,29 +151,26 @@ pub(crate) fn convert_module_code(
     ty_idx: u32,
     options: &ParserOptions,
 ) -> Result<(FunctionCode, Option<FuncValidatorAllocations>, OperatorsReaderAllocations)> {
-    let locals_reader = func.get_locals_reader()?;
-    #[cfg(feature = "validate")]
-    let locals_position = locals_reader.original_position();
+    let mut locals_reader = func.get_locals_reader()?;
     let signature = metadata.signature(ty_idx)?.clone();
     let mut local_types = signature.params.clone();
 
     #[cfg(feature = "validate")]
     let mut validator = validator;
 
-    #[cfg(feature = "validate")]
-    for (local_index, local) in locals_reader.into_iter().enumerate() {
-        let local = local?;
+    for _ in 0..locals_reader.get_count() {
+        #[cfg(feature = "validate")]
+        let position = locals_reader.original_position();
+        let local = locals_reader.read()?;
+        #[cfg(feature = "validate")]
         if let Some(validator) = validator.as_mut() {
-            validator.define_locals(locals_position + local_index as u64, local.0, local.1)?;
+            validator.define_locals(position, local.0, local.1)?;
         }
         extend_local_types(&mut local_types, local.0, local.1)?;
     }
 
     #[cfg(not(feature = "validate"))]
-    for local in locals_reader {
-        let local = local?;
-        extend_local_types(&mut local_types, local.0, local.1)?;
-    }
+    let _ = validator;
 
     // maps a local's address to the index in the type's locals array
     let mut local_addr_map = Vec::with_capacity(local_types.len());

crates/tinywasm/src/instance.rs

@@ -176,7 +176,10 @@ impl ModuleInstance {
         let imported_funcs = addrs.funcs.len();
         addrs.funcs.extend(store.init_funcs(&module.funcs, id, &module.func_type_idxs[imported_funcs..], &type_addrs));
         addrs.tags.extend(store.init_tags(&module.tags, &type_addrs));
-        addrs.memories.extend(store.init_memories(&module.memory_types, MemoryInstance::new)?);
+        let limiter = store.engine.config().resource_limiter.clone();
+        addrs
+            .memories
+            .extend(store.init_memories(&module.memory_types, |ty| MemoryInstance::new(ty, limiter.as_deref()))?);
 
         store.init_globals(&mut addrs.globals, &module.globals, &addrs.funcs, &type_addrs)?;
         addrs.tables.extend(store.init_tables(&module.tables, &addrs.globals, &addrs.funcs, &type_addrs)?);

crates/tinywasm/src/lib.rs

@@ -55,7 +55,8 @@
 //!
 //! For non-default runtime behavior, construct a [`Store`] with a custom [`Engine`]
 //! and [`engine::Config`] to control stack sizing, fuel accounting, and trap-on-OOM
-//! behavior. A [`ResourceLimiter`] can be attached to a [`Store`] to bound memory growth.
+//! behavior. A [`ResourceLimiter`] can be attached to the engine configuration to bound memory
+//! allocation and growth for stores created from that engine.
 //!
 //! For more examples, see the [`examples`](https://github.com/explodingcamera/tinywasm/tree/main/examples) directory.
 //!

crates/tinywasm/src/reference.rs

@@ -163,7 +163,8 @@ impl Memory {
     /// Create a new memory in the given store.
     pub fn new(store: &mut Store, ty: MemoryType) -> Result<Self> {
         let addr = store.state.memories.len() as MemAddr;
-        store.state.memories.push(MemoryInstance::new(ty)?);
+        let limiter = store.engine.config().resource_limiter.clone();
+        store.state.memories.push(MemoryInstance::new(ty, limiter.as_deref())?);
         Ok(Self(StoreItem::new(store.id(), addr)))
     }
 
@@ -230,17 +231,16 @@ impl Memory {
 
     /// Reads up to `dst.len()` bytes from memory and returns the number of bytes read.
     ///
-    /// Depending on the configured backend, this may return fewer bytes than requested even when
-    /// more data is available. Use [`Self::read_exact`] or [`Self::read_vec`] when you need a full
-    /// range.
+    /// This returns fewer bytes than requested when the range extends past the end of memory. Use
+    /// [`Self::read_exact`] or [`Self::read_vec`] when you need a full range.
     pub fn read(&self, store: &Store, offset: usize, dst: &mut [u8]) -> Result<usize> {
         Ok(self.instance(store)?.inner.read(offset, dst))
     }
 
     /// Writes up to `src.len()` bytes into memory and returns the number of bytes written.
     ///
-    /// Depending on the configured backend, this may return fewer bytes than requested even when
-    /// more space is available. Use [`Self::copy_from_slice`] when you need the full slice written.
+    /// This returns fewer bytes than requested when the range extends past the end of memory. Use
+    /// [`Self::copy_from_slice`] when you need the full slice written.
     pub fn write(&self, store: &mut Store, offset: usize, src: &[u8]) -> Result<usize> {
         Ok(self.instance_mut(store)?.inner.write(offset, src))
     }

crates/tinywasm/src/store/memory/instance.rs

@@ -3,7 +3,6 @@ use tinywasm_types::{MemoryArch, MemoryType};
 use crate::{Error, ResourceLimiter, Result, Trap};
 
 use super::{MemoryStorage, memory_oob};
-use core::hint::cold_path;
 
 /// A WebAssembly Memory Instance
 ///
@@ -22,25 +21,17 @@ impl core::fmt::Debug for MemoryInstance {
 }
 
 impl MemoryInstance {
-    const COPY_CHUNK_SIZE: usize = 4 * 1024;
-
+    #[inline]
     fn host_size(kind: MemoryType, pages: u64) -> Result<usize> {
-        #[cfg(target_pointer_width = "64")]
-        {
-            pages
-                .checked_mul(kind.page_size())
-                .map(|size| size as usize)
-                .ok_or(Error::UnsupportedFeature("memory size exceeds the host address space"))
-        }
+        let size = pages
+            .checked_mul(kind.page_size())
+            .ok_or(Error::UnsupportedFeature("memory size exceeds the host address space"))?;
+        usize::try_from(size).map_err(|_| Error::UnsupportedFeature("memory size exceeds the host address space"))
+    }
 
-        #[cfg(not(target_pointer_width = "64"))]
-        {
-            let page_size = usize::try_from(kind.page_size())
-                .map_err(|_| Error::UnsupportedFeature("memory page size exceeds the host address space"))?;
-            let pages = usize::try_from(pages)
-                .map_err(|_| Error::UnsupportedFeature("memory size exceeds the host address space"))?;
-            pages.checked_mul(page_size).ok_or(Error::UnsupportedFeature("memory size exceeds the host address space"))
-        }
+    #[inline]
+    fn maximum_size(kind: MemoryType) -> Option<usize> {
+        kind.page_count_max_declared().map(|pages| Self::host_size(kind, pages).unwrap_or(usize::MAX))
     }
 
     #[inline(always)]
@@ -66,7 +57,7 @@ impl MemoryInstance {
         }
     }
 
-    pub(crate) fn new(kind: MemoryType) -> Result<Self> {
+    pub(crate) fn new(kind: MemoryType, limiter: Option<&dyn ResourceLimiter>) -> Result<Self> {
         let initial_len = Self::host_size(kind, kind.page_count_initial())?;
 
         crate::log::debug!(
@@ -75,6 +66,13 @@ impl MemoryInstance {
             kind.page_size()
         );
 
+        if initial_len != 0
+            && let Some(limiter) = limiter
+            && !cold_err!(limiter.memory_growing(0, initial_len, Self::maximum_size(kind)))?
+        {
+            return cold!(Err(Trap::OutOfMemory.into()));
+        }
+
         let storage = MemoryStorage::try_new(initial_len)?;
         Ok(Self { kind, inner: storage, page_count: kind.page_count_initial() as usize })
     }
@@ -90,47 +88,14 @@ impl MemoryInstance {
         src: usize,
         len: usize,
     ) -> Result<(), Trap> {
-        fn check_range(mem: &MemoryStorage, addr: usize, len: usize) -> Result<(), crate::Trap> {
-            let Some(end) = addr.checked_add(len) else {
-                return cold!(Err(memory_oob(addr, len, mem.len())));
-            };
-
-            if end > mem.len() || end < addr {
-                return cold!(Err(memory_oob(addr, len, mem.len())));
-            }
-            Ok(())
-        }
-
-        check_range(&src_memory.inner, src, len)?;
-        check_range(&self.inner, dst, len)?;
-
-        if len == 0 {
-            return Ok(());
-        }
-
-        let mut buf = [0u8; Self::COPY_CHUNK_SIZE];
-        let mut copied = 0;
-        while copied < len {
-            let chunk_len = buf.len().min(len - copied);
-            src_memory.inner.read_exact(src + copied, &mut buf[..chunk_len]).ok_or_else(|| {
-                cold_path();
-                memory_oob(src + copied, chunk_len, src_memory.inner.len())
-            })?;
-            self.inner.write_all(dst + copied, &buf[..chunk_len]).ok_or_else(|| {
-                cold_path();
-                memory_oob(dst + copied, chunk_len, self.inner.len())
-            })?;
-            copied += chunk_len;
-        }
-
+        src_memory.inner.checked_range(src, len).ok_or_else(|| cold!(memory_oob(src, len, src_memory.inner.len())))?;
+        self.inner.checked_range(dst, len).ok_or_else(|| cold!(memory_oob(dst, len, self.inner.len())))?;
+        self.inner.copy_from(dst, &src_memory.inner, src, len);
         Ok(())
     }
 
     pub(crate) fn copy_within(&mut self, dst: usize, src: usize, len: usize) -> Result<(), Trap> {
-        self.inner.copy_within(dst, src, len).ok_or_else(|| {
-            cold_path();
-            memory_oob(dst, len, self.inner.len())
-        })
+        self.inner.copy_within(dst, src, len).ok_or_else(|| cold!(memory_oob(dst, len, self.inner.len())))
     }
 
     pub(crate) fn grow(
@@ -139,50 +104,34 @@ impl MemoryInstance {
         trap_on_oom: bool,
         limiter: Option<&dyn ResourceLimiter>,
     ) -> Result<Option<i64>, Trap> {
-        if pages_delta < 0 {
-            cold_path();
-            crate::log::debug!("memory.grow failed: negative delta {}", pages_delta);
-            return Ok(None);
-        }
-
         let current_pages = self.page_count;
-        let Some(pages_delta) = usize::try_from(pages_delta).ok() else {
-            return Ok(None);
-        };
-        let Some(new_pages) = current_pages.checked_add(pages_delta) else {
-            return Ok(None);
+        let Some(new_pages) = usize::try_from(pages_delta).ok().and_then(|delta| current_pages.checked_add(delta))
+        else {
+            return cold!(Ok(None));
         };
         let max_pages = self.kind.page_count_max().try_into().unwrap_or(usize::MAX);
 
         if new_pages > max_pages {
-            cold_path();
-            crate::log::debug!("memory.grow failed: new_pages={}, max_pages={}", new_pages, max_pages);
-            return Ok(None);
+            return cold!({
+                crate::log::debug!("memory.grow failed: new_pages={}, max_pages={}", new_pages, max_pages);
+                Ok(None)
+            });
         }
 
         let Ok(new_size) = Self::host_size(self.kind, new_pages as u64) else {
-            return Ok(None);
+            return cold!(Ok(None));
         };
         if new_size == self.inner.len() {
             return Ok(i64::try_from(current_pages).ok());
         }
 
-        if let Some(limiter) = limiter {
-            let maximum = self.kind.page_count_max_declared().and_then(|pages| Self::host_size(self.kind, pages).ok());
-            match limiter.memory_growing(self.inner.len(), new_size, maximum) {
-                Ok(true) => {}
-                Ok(false) => {
-                    cold_path();
-                    return Ok(None);
-                }
-                Err(trap) => {
-                    cold_path();
-                    return Err(trap);
-                }
-            }
+        if let Some(limiter) = limiter
+            && !cold_err!(limiter.memory_growing(self.inner.len(), new_size, Self::maximum_size(self.kind)))?
+        {
+            return cold!(Ok(None));
         }
 
-        if let Err(err) = self.inner.grow_to(new_size) {
+        if let Err(err) = cold_err!(self.inner.grow_to(new_size)) {
             if trap_on_oom {
                 return Err(err);
             }