[Eusgor]

Guest-controlled counts were multiplied by the serialized element size in uint32_t. A length such as 0x20000000 wraps the product to 0, so the bounds check accepts the array and deserialization reads past the end of the WebAssembly memory.

Multiply in size_t and reject an overflowing product before reading the array. The same check covers fd_read, fd_write, fd_pread, fd_pwrite, poll_oneoff, sock_recv, and sock_send.

[nodejs-github-bot]

Review requested:

• @nodejs/wasi

[codecov]

Codecov Report

❌ Patch coverage is 12.50000% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.51%. Comparing base (2052d0d) to head (fc8746d).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
src/node_wasi.cc	12.50%	4 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #66849      +/-   ##
==========================================
+ Coverage   90.50%   90.51%   +0.01%     
==========================================
  Files         797      797              
  Lines      278195   278195              
  Branches    53453    53456       +3     
==========================================
+ Hits       251777   251820      +43     
+ Misses      16795    16754      -41     
+ Partials     9623     9621       -2     

Files with missing lines	Coverage Δ
src/node_wasi.cc	64.16% <12.50%> (+0.14%)	⬆️

... and 28 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.