ANT-2026-0GNNMNPS: Heap-buffer-overflow in wabt

When wat2wasm is run with --enable-annotations on a WAT file containing a @custom annotation inside a function body (e.g. (module(func(@custom "a")))), BinaryWriter::WriteExpr looks up the annotation's name in an unordered_map. The string_view key is malformed — an invalid pointer or underflowed length — so the libstdc++ hash routine reads out of bounds. ASAN reports a deterministic SEGV on a READ at an unknown address, reproducing in 3/3 runs. The agent attributes the root cause to an integer underflow producing a bogus string_view length.

Target

Project: wabt
Location: wabt::BinaryWriter::WriteExpr in binary-writer.cc

Technical Details

ASAN: "SEGV on unknown address 0x603000010000 ... caused by a READ memory access". The SEGV fires inside std::_Hash_impl::hash while hashing a string_view key for an unordered_map lookup in BinaryWriter::WriteExpr. The string_view backing the @custom annotation's name has a corrupted pointer or length (the agent reports an integer underflow in the length field), so the hasher walks off valid memory. ASAN classified this as SEGV rather than heap-buffer-overflow, but both point to the same bad-string_view root cause.

Crash trace (truncated — full trace in attached crash.log):

The PoC file `poc.bin` contains 27 bytes of WAT text: `(module(func(@custom "a")))`. When processed by `wat2wasm-asan --enable-annotations`, it triggers a deterministic SEGV crash in all 3 runs.

ASAN reports: `ERROR: AddressSanitizer: SEGV on unknown address 0x603000010000 ... caused by a READ memory access`.

The symbolized stack trace confirms the crash is in wabt project code:
- Frame #0: `std::_Hash_impl::hash` (libstdc++)
- Frame #1-2: `std::hash<string_view>::operator()` — hashing a corrupted string_view
- Frame #3-5: `unordered_map::operator[]` in `binary-writer.cc`
- Frame #6: `wabt::BinaryWriter::WriteExpr` in `binary-writer.cc`
- Frame #7: `wabt::BinaryWriter::WriteExprList` in `binary-writer.cc`
- Frame #8: `wabt::BinaryWriter::WriteFunc` in `binary-writer.cc`
- Frame #9: `wabt::BinaryWriter::WriteModule` in `binary-writer.cc`
- Frame #10: `wabt::WriteBinaryModule`
- Frame #11: `ProgramMain`
- Frame #12: `main`

The crash occurs when `BinaryWriter::WriteExpr` looks up a `@custom` annotation's name in an `unordered_map<string_view, CodeMetadataSection>`, but the `string_view` has an invalid/corrupted pointer or length, causing ASAN to detect a SEGV during the hash computation. This is consistent with the agent's reported "heap-buffer-overflow (OOB read via integer underflow in string_view length)."

The slight score reduction from 1.0 is because the ASAN error type reported is SEGV rather than the claimed "heap-buffer-overflow," though both indicate invalid memory reads and the root cause (bad string_view) is consistent.

Reproduction

1. Create a WAT file containing a @custom annotation inside a function body, e.g. (module(func(@custom "a")))
2. Invoke wat2wasm --enable-annotations on the file
3. BinaryWriter::WriteExpr hashes a corrupted string_view and crashes

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-0GNNMNPS.

Reference: ANT-2026-0GNNMNPS
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure