chore: simplify parser limits

Signed-off-by: Henry <mail@henrygressmann.de>

Author: explodingcamera

README.md

@@ -75,7 +75,7 @@ Applications that only load `.twasm` can remove the parser and validator from th
 
 WebAssembly [validation](https://webassembly.github.io/spec/core/valid/index.html) is enabled by default through the `validate` feature. Keep this feature enabled and leave `ParserOptions::validation` enabled for modules from untrusted sources. Without validation, parsing can produce modules that violate runtime assumptions and may panic during instantiation or execution.
 
-Validation does not limit parsing or execution resources. Hosts that run untrusted code should also set opt-in `parser::ParseLimits` for input and known parse-time amplification points, configure stack and `ResourceLimiter` limits, and use fuel- or time-budgeted execution as needed.
+Validation does not limit parsing or execution resources. Hosts that run untrusted code should also configure `parser::ParseLimits`, stack and `ResourceLimiter` limits, and fuel- or time-budgeted execution as needed.
 
 Loading `.twasm` checks the archive header and encoding but does not run WebAssembly validation or verify TinyWasm's runtime invariants. Load archives only from trusted sources. For untrusted input, parse a WebAssembly binary with validation enabled.
 

crates/parser/README.md

@@ -12,7 +12,7 @@ This crate provides the parser and lowering pipeline that converts WebAssembly b
 ## Usage
 
 ```rust
-use tinywasm_parser::{ParseLimits, Parser, ParserOptions};
+use tinywasm_parser::{Parser, ParserOptions};
 
 let bytes = include_bytes!("./file.wasm");
 
@@ -22,23 +22,11 @@ let module = parser.parse_module_bytes(bytes)?;
 let parser = Parser::new(ParserOptions::default().with_optimize(false));
 let module = parser.parse_module_bytes(bytes)?;
 
-// Select explicit bounds before accepting untrusted input. Keep validation on.
-let limits = ParseLimits::new()
-    .with_max_module_bytes(16 * 1024 * 1024)
-    .with_max_section_items(100_000)
-    .with_max_function_locals(10_000)
-    .with_max_br_table_targets(4_096)
-    .with_max_array_new_fixed_elements(4_096);
-let parser = Parser::new(ParserOptions::default().with_limits(limits));
-let module = parser.parse_module_bytes(bytes)?;
-
 let module = parser.parse_module_file("path/to/file.wasm")?;
 let mut stream = std::fs::File::open("path/to/file.wasm")?;
 let module = parser.parse_module_stream(&mut stream)?;
 ```
 
 If you just want the default configuration, the top-level `parse_bytes`, `parse_file`, and `parse_stream` helpers are thin wrappers around `Parser::default()`.
 
-The limits are opt-in and disabled by default. They bound encoded input and
-known parse-time amplification points; they are not a hard cap on peak memory
-or elapsed time. A host should also bound guest runtime resources after parsing.
+For untrusted modules, keep validation enabled and configure [`ParseLimits`](https://docs.rs/tinywasm-parser/latest/tinywasm_parser/struct.ParseLimits.html).

crates/parser/src/conversion.rs

@@ -165,11 +165,7 @@ pub(crate) fn convert_module_code(
 ) -> Result<(FunctionCode, Option<FuncValidatorAllocations>, OperatorsReaderAllocations)> {
     let mut locals_reader = func.get_locals_reader()?;
     let mut local_types = metadata.signature(context.ty_idx)?.params.clone();
-    crate::check_parse_limit(
-        crate::ParseLimitKind::FunctionLocals,
-        options.limits.max_function_locals,
-        local_types.len(),
-    )?;
+    options.limits.check(crate::ParseLimitKind::FunctionLocals, local_types.len())?;
 
     #[cfg(feature = "validate")]
     let mut validator = validator;
@@ -182,7 +178,7 @@ pub(crate) fn convert_module_code(
             .len()
             .checked_add(local.0 as usize)
             .ok_or_else(|| crate::ParseError::Other("function local count overflow".into()))?;
-        crate::check_parse_limit(crate::ParseLimitKind::FunctionLocals, options.limits.max_function_locals, expanded)?;
+        options.limits.check(crate::ParseLimitKind::FunctionLocals, expanded)?;
         #[cfg(feature = "validate")]
         if let Some(validator) = validator.as_mut() {
             validator.define_locals(position, local.0, local.1)?;

crates/parser/src/error.rs

@@ -1,35 +1,8 @@
+use crate::ParseLimitKind;
 use alloc::string::{String, ToString};
 use core::fmt::{Debug, Display};
 use wasmparser::Encoding;
 
-/// The input or parse-time expansion limit that was exceeded.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum ParseLimitKind {
-    /// Encoded module bytes.
-    ModuleBytes,
-    /// Materialized entries in one module section.
-    SectionItems,
-    /// Parameters plus declared locals in one function.
-    FunctionLocals,
-    /// Explicit targets in one `br_table`.
-    BrTableTargets,
-    /// Elements in one `array.new_fixed`.
-    ArrayNewFixedElements,
-}
-
-impl Display for ParseLimitKind {
-    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
-        let name = match self {
-            Self::ModuleBytes => "module bytes",
-            Self::SectionItems => "section items",
-            Self::FunctionLocals => "function locals",
-            Self::BrTableTargets => "br_table targets",
-            Self::ArrayNewFixedElements => "array.new_fixed elements",
-        };
-        f.write_str(name)
-    }
-}
-
 #[derive(Debug, PartialEq, Eq)]
 /// Errors that can occur when parsing a WebAssembly module
 pub enum ParseError {

crates/parser/src/lib.rs

@@ -32,19 +32,18 @@ pub(crate) mod log {
 mod conversion;
 mod emitter;
 mod error;
+mod limits;
 mod macros;
 mod module;
 mod selection;
 mod validation;
 mod visit;
 
-#[cfg(all(test, feature = "std"))]
-mod tests;
-
 #[cfg(parallel_parser)]
 mod parallel;
 
 pub use error::*;
+pub use limits::{ParseLimitKind, ParseLimits};
 use module::ModuleReader;
 use validation::Validator;
 
@@ -53,79 +52,6 @@ use wasmparser::WasmFeatures;
 
 pub use tinywasm_types::Module;
 
-/// Optional limits for parsing modules from untrusted sources.
-///
-/// These limit encoded input and specific forms of parse-time expansion. They do
-/// not constitute a hard bound on the parser's total memory use. Validation
-/// should remain enabled for untrusted modules.
-#[non_exhaustive]
-#[derive(Debug, Clone, Copy, Default)]
-pub struct ParseLimits {
-    /// Maximum encoded module size in bytes, including custom sections.
-    pub max_module_bytes: Option<usize>,
-    /// Maximum materialized entries in any one section. Recursive type groups
-    /// and compact imports count by their expanded entries.
-    pub max_section_items: Option<usize>,
-    /// Maximum parameters plus declared locals in any one function.
-    pub max_function_locals: Option<usize>,
-    /// Maximum explicit targets in one `br_table` (excluding its default).
-    pub max_br_table_targets: Option<usize>,
-    /// Maximum elements in one `array.new_fixed`.
-    pub max_array_new_fixed_elements: Option<usize>,
-}
-
-impl ParseLimits {
-    /// Create limits with every bound disabled.
-    pub const fn new() -> Self {
-        Self {
-            max_module_bytes: None,
-            max_section_items: None,
-            max_function_locals: None,
-            max_br_table_targets: None,
-            max_array_new_fixed_elements: None,
-        }
-    }
-
-    /// Bound the encoded size of a module.
-    pub const fn with_max_module_bytes(mut self, limit: usize) -> Self {
-        self.max_module_bytes = Some(limit);
-        self
-    }
-
-    /// Bound the number of materialized entries in each section.
-    pub const fn with_max_section_items(mut self, limit: usize) -> Self {
-        self.max_section_items = Some(limit);
-        self
-    }
-
-    /// Bound parameters plus declared locals in each function.
-    pub const fn with_max_function_locals(mut self, limit: usize) -> Self {
-        self.max_function_locals = Some(limit);
-        self
-    }
-
-    /// Bound explicit targets in each `br_table`.
-    pub const fn with_max_br_table_targets(mut self, limit: usize) -> Self {
-        self.max_br_table_targets = Some(limit);
-        self
-    }
-
-    /// Bound elements in each `array.new_fixed`.
-    pub const fn with_max_array_new_fixed_elements(mut self, limit: usize) -> Self {
-        self.max_array_new_fixed_elements = Some(limit);
-        self
-    }
-}
-
-pub(crate) fn check_parse_limit(kind: ParseLimitKind, limit: Option<usize>, observed: usize) -> Result<()> {
-    if let Some(limit) = limit
-        && observed > limit
-    {
-        return Err(ParseError::LimitExceeded { kind, limit });
-    }
-    Ok(())
-}
-
 /// Parser optimization and lowering options.
 #[non_exhaustive]
 #[derive(Debug, Clone)]
@@ -279,33 +205,19 @@ impl Parser {
 
     #[cfg(feature = "std")]
     fn read_more(
+        &self,
         stream: &mut impl std::io::Read,
         buffer: &mut alloc::vec::Vec<u8>,
         hint: usize,
         total_read: &mut usize,
-        max_module_bytes: Option<usize>,
     ) -> Result<usize> {
         let len = buffer.len();
         // Size hints can come from untrusted section lengths.
         let mut increment = hint.clamp(1, 64 * 1024);
-        if let Some(limit) = max_module_bytes {
+        if let Some(limit) = self.options.limits.max_module_bytes {
             let remaining = limit.saturating_sub(*total_read);
-            if remaining == 0 {
-                // A module exactly at the limit may still need an EOF probe.
-                let mut extra = [0];
-                let read_bytes = loop {
-                    match stream.read(&mut extra) {
-                        Ok(read_bytes) => break read_bytes,
-                        Err(e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
-                        Err(e) => return Err(ParseError::Other(alloc::format!("Error reading from stream: {e}"))),
-                    }
-                };
-                if read_bytes != 0 {
-                    return Err(ParseError::LimitExceeded { kind: ParseLimitKind::ModuleBytes, limit });
-                }
-                return Ok(0);
-            }
-            increment = increment.min(remaining);
+            // Leave room for one byte beyond the limit to distinguish EOF.
+            increment = increment.min(remaining.saturating_add(1));
         }
         let new_len =
             len.checked_add(increment).ok_or_else(|| ParseError::Other("stream buffer is too large".into()))?;
@@ -324,15 +236,17 @@ impl Parser {
             }
         };
         buffer.truncate(len + read_bytes);
-        *total_read =
+        let next_total =
             total_read.checked_add(read_bytes).ok_or_else(|| ParseError::Other("stream byte count overflow".into()))?;
+        self.options.limits.check(ParseLimitKind::ModuleBytes, next_total)?;
+        *total_read = next_total;
         Ok(read_bytes)
     }
 
     /// Parse a [`Module`] from bytes
     pub fn parse_module_bytes(&self, wasm: impl AsRef<[u8]>) -> Result<Module> {
         let wasm = wasm.as_ref();
-        check_parse_limit(ParseLimitKind::ModuleBytes, self.options.limits.max_module_bytes, wasm.len())?;
+        self.options.limits.check(ParseLimitKind::ModuleBytes, wasm.len())?;
         let mut validator = self.validator();
         let mut reader = ModuleReader::default();
 
@@ -383,13 +297,7 @@ impl Parser {
                         buffer.truncate(buffer.len() - buffer_offset);
                         buffer_offset = 0;
                     }
-                    let read_bytes = Self::read_more(
-                        &mut stream,
-                        &mut buffer,
-                        hint,
-                        &mut total_read,
-                        self.options.limits.max_module_bytes,
-                    )?;
+                    let read_bytes = self.read_more(&mut stream, &mut buffer, hint, &mut total_read)?;
                     eof = read_bytes == 0;
                 }
                 wasmparser::Chunk::Parsed { consumed, payload } => {
@@ -422,13 +330,7 @@ impl Parser {
                     if let Some((count, section_size)) = deferred_code_section {
                         while buffer.len() - buffer_offset < section_size {
                             let remaining = section_size - (buffer.len() - buffer_offset);
-                            let read_bytes = Self::read_more(
-                                &mut stream,
-                                &mut buffer,
-                                remaining,
-                                &mut total_read,
-                                self.options.limits.max_module_bytes,
-                            )?;
+                            let read_bytes = self.read_more(&mut stream, &mut buffer, remaining, &mut total_read)?;
                             if read_bytes == 0 {
                                 return Err(ParseError::ParseError {
                                     message: "unexpected end-of-file".into(),
@@ -452,13 +354,7 @@ impl Parser {
                         }
 
                         if !eof {
-                            let read_bytes = Self::read_more(
-                                &mut stream,
-                                &mut buffer,
-                                1,
-                                &mut total_read,
-                                self.options.limits.max_module_bytes,
-                            )?;
+                            let read_bytes = self.read_more(&mut stream, &mut buffer, 1, &mut total_read)?;
                             eof = read_bytes == 0;
 
                             if !eof {