fix: harden instantiation, stream parsing, and host reentrancy

Signed-off-by: Henry <mail@henrygressmann.de>

Author: explodingcamera

CHANGELOG.md

@@ -61,6 +61,9 @@ This release adds garbage collection and typed function reference support, singl
 
 ### Fixed
 
+- Failed instantiation now preserves complete element and data segment mappings for functions exposed through imported tables, and stops data initialization when element initialization traps.
+- Stream parsing now bounds read increments instead of allocating declared section sizes up front, and retries interrupted reads.
+- Reentrant host calls now enforce a separate depth limit based on the configured call-stack size instead of allowing unbounded native-stack recursion.
 - Instantiation now rejects directly defined imports that contain handles from another `Store`.
 - Tail calls to host functions now return directly to the caller frame.
 - Memory64 bulk-memory operations and optimized stores now use the correct value-stack lanes.

README.md

@@ -48,17 +48,17 @@ See the [examples](./examples) directory and [documentation](https://docs.rs/tin
 
 ## Cargo Features
 
-- **`full`:** Enables `archive`, `parallel-parser`, `parser`, and `validate`. Enabled by default.
+- **`full`:** Enables `archive`, `debug`, `parallel-parser`, `parser`, `state`, and `validate`. Enabled by default.
 - **`std`:** Enables `std` and parsing from files and streams. Enabled by default.
 - **`parser`:** Enables `tinywasm-parser` and top-level parse helpers. Enabled by default.
 - **`validate`:** Enables WebAssembly validation while parsing. Enabled by default and configurable through [`ParserOptions`](https://docs.rs/tinywasm/latest/tinywasm/parser/struct.ParserOptions.html).
 - **`parallel-parser`:** Parallelizes function parsing when `std` is enabled. Enabled by default.
 - **`archive`:** Enables serialization and deserialization of the internal `twasm` format. Enabled by default.
-- **`log`:** Enables integration with the `log` crate. Enabled by default.
+- **`log`:** Enables integration with the `log` crate.
 - **`send`:** Makes stores and store-local handles movable across threads.
-- **`state`:** Adds store-owned host state for access from host callbacks.
+- **`state`:** Adds store-owned host state for access from host callbacks. Enabled by default.
 - **`portable-atomic`:** Supports targets without native atomic compare-and-swap.
-- **`canonicalize-nans`:** Uses a [canonical NaN](https://en.wikipedia.org/wiki/NaN#Canonical_NaN) for normalized NaN results. Enabled by default.
+- **`canonicalize-nans`:** Uses a [canonical NaN](https://en.wikipedia.org/wiki/NaN#Canonical_NaN) for normalized NaN results.
 - **`debug`:** Derives `Debug` for runtime types. Enabled by default.
 - **`guest-debug`:** Exposes module-internal by-index inspection APIs (`*_by_index`).
 - **`nightly-tail-calls`:** Uses Rust's unstable explicit tail calls for interpreter dispatch. Requires nightly Rust (recommended for maximum performance).

crates/parser/src/lib.rs

@@ -190,10 +190,24 @@ impl Parser {
     #[cfg(feature = "std")]
     fn read_more(stream: &mut impl std::io::Read, buffer: &mut alloc::vec::Vec<u8>, hint: usize) -> Result<usize> {
         let len = buffer.len();
-        buffer.resize(len + hint, 0);
-        let read_bytes = stream
-            .read(&mut buffer[len..])
-            .map_err(|e| ParseError::Other(alloc::format!("Error reading from stream: {e}")))?;
+        // Size hints can come from untrusted section lengths.
+        let increment = hint.clamp(1, 64 * 1024);
+        let new_len =
+            len.checked_add(increment).ok_or_else(|| ParseError::Other("stream buffer is too large".into()))?;
+        buffer
+            .try_reserve(increment)
+            .map_err(|e| ParseError::Other(alloc::format!("Error reserving stream buffer: {e}")))?;
+        buffer.resize(new_len, 0);
+        let read_bytes = loop {
+            match stream.read(&mut buffer[len..]) {
+                Ok(read_bytes) => break read_bytes,
+                Err(e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
+                Err(e) => {
+                    buffer.truncate(len);
+                    return Err(ParseError::Other(alloc::format!("Error reading from stream: {e}")));
+                }
+            }
+        };
         buffer.truncate(len + read_bytes);
         Ok(read_bytes)
     }

crates/tinywasm/src/engine.rs

@@ -68,7 +68,8 @@ const DEFAULT_MAX_CALL_STACK_SIZE: usize = 1024; // 1024 frames
 pub struct StackConfig {
     /// Initial reserved capacity for the stack.
     pub initial_size: usize,
-    /// Maximum number of elements the stack may contain.
+    /// Growth threshold, checked only when the stack reaches its allocated capacity.
+    /// Dynamic stacks may exceed this threshold up to their allocated capacity.
     pub max_size: usize,
     /// Whether the stack may grow past its initial capacity.
     pub dynamic: bool,
@@ -80,7 +81,9 @@ impl StackConfig {
         Self { initial_size: size, max_size: size, dynamic: false }
     }
 
-    /// Creates a dynamically growing stack with the given initial and maximum sizes.
+    /// Creates a dynamically growing stack with the given initial size and growth threshold.
+    ///
+    /// The threshold is not a strict element limit, see [`Self::max_size`].
     pub const fn dynamic(initial_size: usize, max_size: usize) -> Self {
         assert!(initial_size <= max_size, "initial_size must be less than or equal to max_size");
         Self { initial_size, max_size, dynamic: true }

crates/tinywasm/src/func/context.rs

@@ -89,7 +89,9 @@ impl FuncContext<'_> {
 
         let call_stack_base = self.store.call_stack.len();
         let value_stack_base = self.store.value_stack.base();
-        func.call_untyped(self.store, type_addr, args, results, call_stack_base, value_stack_base)
+        self.with_reentrant_call(|store| {
+            func.call_untyped(store, type_addr, args, results, call_stack_base, value_stack_base)
+        })
     }
 
     /// Calls a Store-aware function reference in the current module context.
@@ -117,7 +119,23 @@ impl FuncContext<'_> {
         func.func.item.validate_store(self.store)?;
         let call_stack_base = self.store.call_stack.len();
         let value_stack_base = self.store.value_stack.base();
-        func.func.call_typed(self.store, params.into_wasm_values(), call_stack_base, value_stack_base)
+        self.with_reentrant_call(|store| {
+            func.func.call_typed(store, params.into_wasm_values(), call_stack_base, value_stack_base)
+        })
+    }
+
+    fn with_reentrant_call<R>(&mut self, call: impl FnOnce(&mut crate::Store) -> Result<R>) -> Result<R> {
+        // Each nested executor keeps its current frame on the native stack,
+        // outside CallStack, even when the Wasm function has no params or locals.
+        let config = self.store.engine.config().call_stack;
+        let limit = if config.dynamic { config.max_size } else { config.initial_size };
+        if self.store.reentrant_call_depth >= limit {
+            return Err(crate::Trap::CallStackOverflow.into());
+        }
+        self.store.reentrant_call_depth += 1;
+        let result = call(self.store);
+        self.store.reentrant_call_depth -= 1;
+        result
     }
 }
 

crates/tinywasm/src/instance.rs

@@ -189,10 +189,8 @@ impl ModuleInstance {
 
         store.init_globals(&mut addrs.globals, &module.globals, &addrs.funcs, &type_addrs)?;
         addrs.tables.extend(store.init_tables(&module.tables, &addrs.globals, &addrs.funcs, &type_addrs)?);
-        let (elem_addrs, elem_trapped) =
-            store.init_elements(&addrs.tables, &addrs.funcs, &addrs.globals, &module.elements, &type_addrs)?;
-        let (data_addrs, data_trapped) =
-            store.init_data(&addrs.memories, &addrs.globals, &addrs.funcs, &module.data, &type_addrs)?;
+        let elem_addrs = store.alloc_elements(&addrs.funcs, &addrs.globals, &module.elements, &type_addrs)?;
+        let data_addrs = store.alloc_data(&module.data);
 
         let instance = ModuleInstanceInner {
             store_id: store.id(),
@@ -210,11 +208,25 @@ impl ModuleInstance {
         };
 
         let instance = ModuleInstance(StoreShared::new(instance));
+        // Earlier table writes can expose functions even if a later segment traps.
         store.add_instance(instance.clone());
 
-        if let Some(trap) = elem_trapped.or(data_trapped) {
-            return cold!(Err(trap.into()));
-        }
+        store.init_elements(
+            &instance.0.table_addrs,
+            &instance.0.func_addrs,
+            &instance.0.global_addrs,
+            &module.elements,
+            &instance.0.type_addrs,
+            &instance.0.elem_addrs,
+        )?;
+        store.init_data(
+            &instance.0.mem_addrs,
+            &instance.0.global_addrs,
+            &instance.0.func_addrs,
+            &module.data,
+            &instance.0.type_addrs,
+            &instance.0.data_addrs,
+        )?;
         Ok(instance)
     }
 

crates/tinywasm/src/interpreter/stack/call_stack.rs

@@ -37,6 +37,8 @@ impl CallStack {
 
     #[inline(always)]
     pub(crate) fn push(&mut self, mut call_frame: CallFrame, instr_ptr: usize) -> Result<(), Trap> {
+        // Check the limit only at capacity to avoid an extra hot-path check. Vec growth may
+        // intentionally overshoot max_size. Revisit when Vec::push_within_capacity is stable.
         if self.stack.len() == self.stack.capacity() && (!self.dynamic || self.stack.len() >= self.max_size) {
             return cold!(Err(Trap::CallStackOverflow));
         }

crates/tinywasm/src/interpreter/stack/value_stack.rs

@@ -46,6 +46,8 @@ impl<T: Copy + Default> Stack<T> {
 
     #[inline(always)]
     pub(crate) fn push(&mut self, value: T) -> Result<(), Trap> {
+        // Check the limit only at capacity to avoid an extra hot-path check. Vec growth may
+        // intentionally overshoot max_size. Revisit when Vec::push_within_capacity is stable.
         if self.data.len() == self.data.capacity() && (!self.dynamic || self.data.len() >= self.max_size) {
             return cold!(Err(Trap::ValueStackOverflow));
         }
@@ -55,6 +57,7 @@ impl<T: Copy + Default> Stack<T> {
 
     #[inline(always)]
     pub(crate) fn push_copy(&mut self, index: usize) -> Result<(), Trap> {
+        // Keep the same capacity-based limit check as push, including intentional overshoot.
         if self.data.len() == self.data.capacity() && (!self.dynamic || self.data.len() >= self.max_size) {
             return cold!(Err(Trap::ValueStackOverflow));
         }

crates/tinywasm/src/lib.rs

@@ -65,16 +65,17 @@
 //!
 //! ## Cargo features
 //!
-//! - **`full`:** Enables `archive`, `parallel-parser`, `parser`, and `validate`. Enabled by default.
+//! - **`full`:** Enables `archive`, `debug`, `parallel-parser`, `parser`, `state`, and `validate`. Enabled by default.
 //! - **`std`:** Enables `std` and parsing from files and streams. Enabled by default.
 //! - **`parser`:** Enables `tinywasm-parser` and top-level parse helpers. Enabled by default.
 //! - **`validate`:** Enables WebAssembly validation while parsing. Enabled by default and configurable through `ParserOptions`.
 //! - **`parallel-parser`:** Parallelizes function parsing when `std` is enabled. Enabled by default.
 //! - **`archive`:** Enables serialization and deserialization of the internal `twasm` format. Enabled by default.
-//! - **`log`:** Enables integration with the `log` crate. Enabled by default.
+//! - **`log`:** Enables integration with the `log` crate.
 //! - **`send`:** Makes stores and store-local handles movable across threads.
+//! - **`state`:** Adds store-owned host state for access from host callbacks. Enabled by default.
 //! - **`portable-atomic`:** Supports targets without native atomic compare-and-swap.
-//! - **`canonicalize-nans`:** Uses a [canonical NaN](https://en.wikipedia.org/wiki/NaN#Canonical_NaN) for normalized NaN results. Enabled by default.
+//! - **`canonicalize-nans`:** Uses a [canonical NaN](https://en.wikipedia.org/wiki/NaN#Canonical_NaN) for normalized NaN results.
 //! - **`debug`:** Derives `Debug` for runtime types. Enabled by default.
 //! - **`guest-debug`:** Exposes module-internal by-index inspection APIs (`*_by_index`).
 //! - **`nightly-tail-calls`:** Uses Rust's unstable explicit tail calls for interpreter dispatch. Requires nightly Rust (recommended for maximum performance).

crates/tinywasm/src/store/memory/instance.rs

@@ -101,14 +101,7 @@ impl MemoryInstance {
         src: usize,
         len: usize,
     ) -> Result<(), Trap> {
-        cold_err!(src_mem.inner.checked_range(src, len).ok_or_else(|| memory_oob(src, len, src_mem.inner.len())))?;
-        cold_err!(self.inner.checked_range(dst, len).ok_or_else(|| memory_oob(dst, len, self.inner.len())))?;
-        cold_err!(self.inner.copy_from(dst, &src_mem.inner, src, len).ok_or_else(|| memory_oob(
-            dst,
-            len,
-            self.inner.len()
-        )))?;
-        Ok(())
+        self.inner.copy_from(dst, &src_mem.inner, src, len)
     }
 
     pub(crate) fn copy_within(&mut self, dst: usize, src: usize, len: usize) -> Result<(), Trap> {