## version
```shell
$ git log
commit e37de9dedfc7037cea09ca3c75fd5a544d68cb2a (HEAD -> main, origin/main, origin/HEAD)
Author: Shravan Narayan <shravanrn@gmail.com>
Date:   Tue Jun 20 00:06:25 2023 -0400

    C++20 compatibility fixes

``` 

## Env
```shell
host : Linux user 5.19.0-50-generic #50-Ubuntu SMP PREEMPT_DYNAMIC Mon Jul 10 18:24:29 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
build : make clang-debug-asan

``` 

## Description
During the parsing of the Type section of a wasm binary, an incorrect `datacount` value triggers a huge memory allocation.
When the `new` function is called, it is computed with the value of `sizeof(_Tp)`, a memory allocation of about 40 GB is performed, and out-of-memory is triggered.

![image](https://github.com/WebAssembly/wabt/assets/43521005/aafbda62-157b-4e2f-a97c-74fd988f802c)
poc file : [poc.zip](https://github.com/WebAssembly/wabt/files/12212696/poc.zip)

## ASAN
```shell
./wasm-interp poc
=================================================================
==3235933==ERROR: AddressSanitizer: allocator is out of memory trying to allocate 0x97fffff68 bytes
    #0 0x55c65fb65fad in operator new(unsigned long) (/home/user/wabt_native/wabt/out/clang/Debug/asan/wasm-interp+0x194fad) (BuildId: 0dc6d9725e694cbc297e840e0803233df453bca7)
    #1 0x55c65fb9d1f9 in __gnu_cxx::new_allocator<wabt::interp::DataDesc>::allocate(unsigned long, void const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/ext/new_allocator.h:127:27
    #2 0x55c65fb9d180 in std::allocator_traits<std::allocator<wabt::interp::DataDesc> >::allocate(std::allocator<wabt::interp::DataDesc>&, unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/alloc_traits.h:464:20
    #3 0x55c65fb9d13f in std::_Vector_base<wabt::interp::DataDesc, std::allocator<wabt::interp::DataDesc> >::_M_allocate(unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/stl_vector.h:346:20
    #4 0x55c65fc44805 in std::vector<wabt::interp::DataDesc, std::allocator<wabt::interp::DataDesc> >::reserve(unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/vector.tcc:78:22
    #5 0x55c65fbff044 in wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnDataCount(unsigned int) /home/user/wabt_native/wabt/src/interp/binary-reader-interp.cc:761:17
    #6 0x55c65fd52598 in wabt::(anonymous namespace)::BinaryReader::ReadDataCountSection(unsigned long) /home/user/wabt_native/wabt/src/binary-reader.cc:2827:3
    #7 0x55c65fd3d147 in wabt::(anonymous namespace)::BinaryReader::ReadSections(wabt::(anonymous namespace)::BinaryReader::ReadSectionsOptions const&) /home/user/wabt_native/wabt/src/binary-reader.cc:2950:26
    #8 0x55c65fd39eaa in wabt::(anonymous namespace)::BinaryReader::ReadModule(wabt::(anonymous namespace)::BinaryReader::ReadModuleOptions const&) /home/user/wabt_native/wabt/src/binary-reader.cc:2993:3
    #9 0x55c65fd38eab in wabt::ReadBinary(void const*, unsigned long, wabt::BinaryReaderDelegate*, wabt::ReadBinaryOptions const&) /home/user/wabt_native/wabt/src/binary-reader.cc:3010:17
    #10 0x55c65fbdc59c in wabt::interp::ReadBinaryInterp(std::basic_string_view<char, std::char_traits<char> >, void const*, unsigned long, wabt::ReadBinaryOptions const&, std::vector<wabt::Error, std::allocator<wabt::Error> >*, wabt::interp::ModuleDesc*) /home/user/wabt_native/wabt/src/interp/binary-reader-interp.cc:1609:10
    #11 0x55c65fb71e8e in ReadModule(char const*, std::vector<wabt::Error, std::allocator<wabt::Error> >*, wabt::interp::RefPtr<wabt::interp::Module>*) /home/user/wabt_native/wabt/src/tools/wasm-interp.cc:324:3
    #12 0x55c65fb6b452 in ReadAndRunModule(char const*) /home/user/wabt_native/wabt/src/tools/wasm-interp.cc:351:19
    #13 0x55c65fb6a554 in ProgramMain(int, char**) /home/user/wabt_native/wabt/src/tools/wasm-interp.cc:450:25
    #14 0x55c65fb6b951 in main /home/user/wabt_native/wabt/src/tools/wasm-interp.cc:456:10
    #15 0x7f0079029d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

==3235933==HINT: if you don't care about these errors you may set allocator_may_return_null=1
SUMMARY: AddressSanitizer: out-of-memory (/home/user/wabt_native/wabt/out/clang/Debug/asan/wasm-interp+0x194fad) (BuildId: 0dc6d9725e694cbc297e840e0803233df453bca7) in operator new(unsigned long)
==3235933==ABORTING
``` 

## native execution without ASAN
```shell
git commit : 45bd6a34859551ecd96b8c8ad34bd9c899d70602
``` 
```shell
 ./wasm-interp poc
terminate called after throwing an instance of 'std::bad_alloc'
  what():  std::bad_alloc
Aborted

``` 
huge memory alloc causes SIGABORT signal at reserve function in binary-reader-interp.cc:761
This is a GitHub Issue
repo:wabt
owner:WebAssembly
Title : huge memory alloc causes SIGABORT signal at reserve function in binary-reader-interp.cc:761
Issue date:

--- start body ---
## version
```shell
$ git log
commit e37de9dedfc7037cea09ca3c75fd5a544d68cb2a (HEAD -> main, origin/main, origin/HEAD)
Author: Shravan Narayan <shravanrn@gmail.com>
Date:   Tue Jun 20 00:06:25 2023 -0400

    C++20 compatibility fixes

``` 

## Env
```shell
host : Linux user 5.19.0-50-generic #50-Ubuntu SMP PREEMPT_DYNAMIC Mon Jul 10 18:24:29 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
build : make clang-debug-asan

``` 

## Description
During the parsing of the Type section of a wasm binary, an incorrect `datacount` value triggers a huge memory allocation.
When the `new` function is called, it is computed with the value of `sizeof(_Tp)`, a memory allocation of about 40 GB is performed, and out-of-memory is triggered.

![image](https://github.com/WebAssembly/wabt/assets/43521005/aafbda62-157b-4e2f-a97c-74fd988f802c)
poc file : [poc.zip](https://github.com/WebAssembly/wabt/files/12212696/poc.zip)

## ASAN
```shell
./wasm-interp poc
=================================================================
==3235933==ERROR: AddressSanitizer: allocator is out of memory trying to allocate 0x97fffff68 bytes
    #0 0x55c65fb65fad in operator new(unsigned long) (/home/user/wabt_native/wabt/out/clang/Debug/asan/wasm-interp+0x194fad) (BuildId: 0dc6d9725e694cbc297e840e0803233df453bca7)
    #1 0x55c65fb9d1f9 in __gnu_cxx::new_allocator<wabt::interp::DataDesc>::allocate(unsigned long, void const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/ext/new_allocator.h:127:27
    #2 0x55c65fb9d180 in std::allocator_traits<std::allocator<wabt::interp::DataDesc> >::allocate(std::allocator<wabt::interp::DataDesc>&, unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/alloc_traits.h:464:20
    #3 0x55c65fb9d13f in std::_Vector_base<wabt::interp::DataDesc, std::allocator<wabt::interp::DataDesc> >::_M_allocate(unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/stl_vector.h:346:20
    #4 0x55c65fc44805 in std::vector<wabt::interp::DataDesc, std::allocator<wabt::interp::DataDesc> >::reserve(unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/vector.tcc:78:22
    #5 0x55c65fbff044 in wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnDataCount(unsigned int) /home/user/wabt_native/wabt/src/interp/binary-reader-interp.cc:761:17
    #6 0x55c65fd52598 in wabt::(anonymous namespace)::BinaryReader::ReadDataCountSection(unsigned long) /home/user/wabt_native/wabt/src/binary-reader.cc:2827:3
    #7 0x55c65fd3d147 in wabt::(anonymous namespace)::BinaryReader::ReadSections(wabt::(anonymous namespace)::BinaryReader::ReadSectionsOptions const&) /home/user/wabt_native/wabt/src/binary-reader.cc:2950:26
    #8 0x55c65fd39eaa in wabt::(anonymous namespace)::BinaryReader::ReadModule(wabt::(anonymous namespace)::BinaryReader::ReadModuleOptions const&) /home/user/wabt_native/wabt/src/binary-reader.cc:2993:3
    #9 0x55c65fd38eab in wabt::ReadBinary(void const*, unsigned long, wabt::BinaryReaderDelegate*, wabt::ReadBinaryOptions const&) /home/user/wabt_native/wabt/src/binary-reader.cc:3010:17
    #10 0x55c65fbdc59c in wabt::interp::ReadBinaryInterp(std::basic_string_view<char, std::char_traits<char> >, void const*, unsigned long, wabt::ReadBinaryOptions const&, std::vector<wabt::Error, std::allocator<wabt::Error> >*, wabt::interp::ModuleDesc*) /home/user/wabt_native/wabt/src/interp/binary-reader-interp.cc:1609:10
    #11 0x55c65fb71e8e in ReadModule(char const*, std::vector<wabt::Error, std::allocator<wabt::Error> >*, wabt::interp::RefPtr<wabt::interp::Module>*) /home/user/wabt_native/wabt/src/tools/wasm-interp.cc:324:3
    #12 0x55c65fb6b452 in ReadAndRunModule(char const*) /home/user/wabt_native/wabt/src/tools/wasm-interp.cc:351:19
    #13 0x55c65fb6a554 in ProgramMain(int, char**) /home/user/wabt_native/wabt/src/tools/wasm-interp.cc:450:25
    #14 0x55c65fb6b951 in main /home/user/wabt_native/wabt/src/tools/wasm-interp.cc:456:10
    #15 0x7f0079029d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

==3235933==HINT: if you don't care about these errors you may set allocator_may_return_null=1
SUMMARY: AddressSanitizer: out-of-memory (/home/user/wabt_native/wabt/out/clang/Debug/asan/wasm-interp+0x194fad) (BuildId: 0dc6d9725e694cbc297e840e0803233df453bca7) in operator new(unsigned long)
==3235933==ABORTING
``` 

## native execution without ASAN
```shell
git commit : 45bd6a34859551ecd96b8c8ad34bd9c899d70602
``` 
```shell
 ./wasm-interp poc
terminate called after throwing an instance of 'std::bad_alloc'
  what():  std::bad_alloc
Aborted

``` 
--- end body ---
