How does web-assembly allocate memory addresses

user_18093188 0
Viewed 108

When running the following C code, I get different values for the address of var each time, which is what one would expect.

int main()
{
  int var = 5;
  printf("var: %d\n", var);

  printf("address of var: %p\n", &var);  
  printf("address of var: %d\n", &var);  
  return 0;
}

However if I convert the C to wasm using emsciption and run it, the value for the memory address is the same each time. Does web-assembly hard code memory address?

I've tried reading up on it but have not found a straight forward answer, https://www.cs.uaf.edu/courses/cs301/2014-fall/notes/memory/, https://ariya.io/2019/05/basics-of-memory-access-in-webassembly

webassembly c
1 Answers

In normal execution, the address space of processes will be randomized to mitigate against certain vulnerabilities (this is called Address Space Layout Randomization, ASLR). This includes the main stack address as well as global variables, read only variables etc.

WASM does not yet implement such mitigations yet, and the stack goes right after your global variables, which itself is not randomized either. wasm-ld, the WebAssembly linker has an option (--stack-first) to put it before global data as well, but it will still be static.

See this paper to read more about missing security mitigations in WebAssembly: https://www.usenix.org/system/files/sec20-lehmann.pdf Section 3.3 in the paper talks about the lack of ASLR.

user_7781170
Related