TLDR Tech / InfoSec
Table Flip: A wasm2c Guest Runs a Shell Command on the Host, Through One Unchecked calloc
wasm2c records a guest-declared table size before calling calloc, then continues if calloc returns NULL. A 64 GiB funcref table can fail under RLIMIT_AS, strict Linux overcommit, 32-bit hosts, or memory pressure. Bounds checks then accept indexes against the declared size while NULL-based table accesses resolve to host addresses. The proof of concept leaks libc pointers through the GOT, forges a funcref entry, passes the indirect-call type check, and calls system() to write a host file. A calloc NULL check and table-size cap prevent it.
Read the full story