Add bounds check for function body size in binary reader

[sumleo]

Summary

• ReadCodeSection computed end_offset = body_start_offset + body_size without validating that end_offset falls within the code section boundary (read_end_).
• A crafted module with an oversized body_size could cause the reader to parse past the section end.
• Add an ERROR_UNLESS check that validates end_offset against read_end_, matching the validation pattern used elsewhere for section and subsection sizes.

Details

In binary-reader.cc, ReadCodeSection reads body_size via LEB128 and computes the expected end offset:

uint32_t body_size;
CHECK_RESULT(ReadU32Leb128(&body_size, "function body size"));
Offset body_start_offset = state_.offset;
Offset end_offset = body_start_offset + body_size;
// No validation that end_offset <= read_end_
CALLBACK(BeginFunctionBody, func_index, body_size);

The end_offset is later used to set state_.offset (when skip_function_bodies is true) and passed to ReadFunctionBody as the expected end position. Without bounds validation, a malformed body_size allows reading past the code section boundary.

Fix: Add ERROR_UNLESS(end_offset >= body_start_offset && end_offset <= read_end_, ...) immediately after computing end_offset.

Test plan

• New test BinaryReader.InvalidFunctionBodySize exercises the fix with a wasm module whose function body size (255 bytes) exceeds the code section
• All existing unit tests pass (128 tests)

[sbc100]

Presumably this means we are lacking an upstream spec test for this case?

Maybe add a TODO here to move this test upstream into the spec repo?

[sumleo]

Done, added a TODO to move this test upstream into the spec repo.