From f028ea0da378b18f0037e8e4a633c0d4b0b01239 Mon Sep 17 00:00:00 2001
From: PGZXB <pgzxb@qq.com>
Date: Tue, 10 Feb 2026 15:13:14 +0000
Subject: [PATCH] Fix heap-based buffer overflow in GetReturnCallDropKeepCount
 by adding checks in OnReturnCallExpr

---
 src/interp/binary-reader-interp.cc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/interp/binary-reader-interp.cc b/src/interp/binary-reader-interp.cc
index fb8425c25d..da87611e82 100644
--- a/src/interp/binary-reader-interp.cc
+++ b/src/interp/binary-reader-interp.cc
@@ -1243,6 +1243,9 @@ Result BinaryReaderInterp::OnReturnCallExpr(Index func_index) {
   CHECK_RESULT(
       validator_.OnReturnCall(GetLocation(), Var(func_index, GetLocation())));
 
+  if (func_index >= func_types_.size()) {
+    return Result::Error;
+  }
   FuncType& func_type = func_types_[func_index];
 
   Index drop_count, keep_count, catch_drop_count;