TABLE FLIP: A WASM2C GUEST RUNS A SHELL COMMAND ON THE HOST, THROUGH ONE UNCHECKED CALLOC

Summary from the TLDR InfoSec newsletter

wasm2c records a guest-declared table size before calling calloc, then continues if calloc returns NULL. A 64 GiB funcref table can fail under RLIMIT_AS, strict Linux overcommit, 32-bit hosts, or memory pressure. Bounds checks then accept indexes against the declared size while NULL-based table accesses resolve to host addresses. The proof of concept leaks libc pointers through the GOT, forges a funcref entry, passes the indirect-call type check, and calls system() to write a host file. A calloc NULL check and table-size cap prevent it.