Fix bounds checking pattern in parser

[chfast]

The previous pattern pos + size < end was incorrect leading to
possible undefined behavior and potential addition overflow allowing
the check bypass. The correct check is to compute the remaining size
and compare with the declared size. This way invalid pointer comparison
is replaced with correct pointer subtraction (pos and end are from the
same memory buffer) and integer comparison: (end - pos) < size.

This will be additionally check with extended ASan options in #469.

[codecov]

Codecov Report

Merging #539 into master will increase coverage by 0.00%.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##           master     #539   +/-   ##
=======================================
  Coverage   98.73%   98.73%           
=======================================
  Files          58       58           
  Lines        8681     8703   +22     
=======================================
+ Hits         8571     8593   +22     
  Misses        110      110           

[chfast]

Good refactoring/optimization opportunity after is to pass remaining_size instead of end pointer to parsing function.

[gumb0]

why static?

[gumb0]

And why int, isn't it then signed-unsigned comparison below?

[chfast]

Pointer subtraction returns signed integer. I will use ptrdiff_t for clarity if easily available.
For static I don't remember, I will remove it.

[gumb0]

Could put this line after the comment below

[chfast]

Oh yeah, good point.

[gumb0]

possible undefined behavior

when would it be UB?

[chfast]

when would it be UB?

The adversarial element is size (it comes from the outside).

The first issue is in pos + size expression. Information about "pointer and integer addition":

If both the pointer operand and the result point to elements of the same array object, or one past the last element of the array object, the evaluation shall not produce an overflow; otherwise, the behavior is undefined.

And later this provokes another issue in pointer comparison (pos + size) < end:

When two pointers are subtracted, both shall point to elements of the same array object, or one past the last element of the array object.

In practice, this is a security bug because in case there is a way to have a wasm module with size big enough to cause pos + size overflow the bounds check will be bypassed. Maybe not practical on 64-bit systems as I believe size is limited to 32-bits. Still worth exploring in context of other wasm binary readers.