fix: harden the compiler-to-VM trust boundary - #481

Merged

zharinov merged 17 commits into

masterfrom

invariant-hardening

Jun 16, 2026

Commits on Jun 16, 2026

refactor(bytecode): split module load/validation into module/load.rs
zharinov
committed
75fed5d
fix(bytecode): reject out-of-range type ids referenced by type defs at load
zharinov
committed
71bd874
fix(bytecode): reject out-of-range TypeName type id at load
zharinov
committed
d20bc9a
refactor(bytecode): move effect-stack validator and module tests
zharinov
committed
46d3f54
refactor(bytecode): keep the load error and boundary-only helpers in load.rs
zharinov
committed
31642ce
fix(bytecode): reject non-zero TypeDef reserved fields at load
zharinov
committed
182ae87
fix(bytecode): reject non-zero entrypoint padding at load
zharinov
committed
edf0a1e
fix(bytecode): reject non-zero instruction padding at load
zharinov
committed
dd0544a
fix(bytecode): reject set extended-Match reserved count bit at load
zharinov
committed
4602d88
fix(bytecode): reject non-zero predicate reserved bits at load
zharinov
committed
6e80dbc
fix(bytecode): reject non-zero regex-table reserved fields at load
zharinov
committed
74b220f
fix(bytecode): reject non-zero section-alignment padding at load
zharinov
committed
37d6671
fix(bytecode): reject non-zero node-kind bits on Call/Return/Trampoline at load
zharinov
committed
9705321
fix(vm): assert ip addresses a validated step before decode
zharinov
committed
6ef1116
fix(vm): harden recursion-depth decrement and mirror frame depth
zharinov
committed
f2627c9
fix(vm): assert Return ascends to the caller's saved depth
zharinov
committed
f2bae42
fix(vm): assert checkpoint restore matches the snapshot
zharinov
committed
95b6b61

Navigation Menu

Uh oh!

fix: harden the compiler-to-VM trust boundary - #481

fix: harden the compiler-to-VM trust boundary#481
zharinov merged 17 commits into
masterfrom
invariant-hardening

Commits on Jun 16, 2026

refactor(bytecode): split module load/validation into module/load.rs

fix(bytecode): reject out-of-range type ids referenced by type defs at load

fix(bytecode): reject out-of-range TypeName type id at load

refactor(bytecode): move effect-stack validator and module tests

refactor(bytecode): keep the load error and boundary-only helpers in load.rs

fix(bytecode): reject non-zero TypeDef reserved fields at load

fix(bytecode): reject non-zero entrypoint padding at load

fix(bytecode): reject non-zero instruction padding at load

fix(bytecode): reject set extended-Match reserved count bit at load

fix(bytecode): reject non-zero predicate reserved bits at load

fix(bytecode): reject non-zero regex-table reserved fields at load

fix(bytecode): reject non-zero section-alignment padding at load

fix(bytecode): reject non-zero node-kind bits on Call/Return/Trampoline at load

fix(vm): assert ip addresses a validated step before decode

fix(vm): harden recursion-depth decrement and mirror frame depth

fix(vm): assert Return ascends to the caller's saved depth

fix(vm): assert checkpoint restore matches the snapshot