vm: fix callframe double free on unhanded exceptions

When invoking a native function as toplevel VM call which indirectly
triggers an unhandled exception in managed code, the callframes are
completely reset before the C function returns, leading to invalid
memory accesses when `uc_vm_call_native()` subsequently popped it's
own callframe again.

This issue did not surface by executing script code through the
interpreter since in this case the VM will always execute a managed
code as toplevel call, but it could be triggered by invoking a native
function triggering an exception through the C API using `uc_vm_call()`
on a fresh `uc_vm_t` context or by utilizing the CLI interpreters `-l`
flag to preload a native code library triggering an exception.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

1 files changed, 4 insertions, 2 deletions

diff --git a/vm.c b/vm.c
index 0c756d7..45e6f42 100644
--- a/vm.c
+++ b/vm.c
@@ -435,8 +435,10 @@ uc_vm_call_native(uc_vm_t *vm, uc_value_t *ctx, uc_cfunction_t *fptr, bool mcall
 
 	res = fptr->cfn(vm, nargs);
 
-	/* reset stack */
-	ucv_put(uc_vm_callframe_pop(vm));
+	/* Reset stack, check for callframe depth since an uncatched exception in managed
+	 * code executed by fptr->cfn() could've reset the callframe stack already. */
+	if (vm->callframes.count > 0)
+		ucv_put(uc_vm_callframe_pop(vm));
 
 	/* push return value */
 	if (!vm->exception.type)