cm-async: Cap read/write sizes on streams (#13086)

* cm-async: Cap read/write sizes on streams

The spec mandates that stream operations cannot exceed `2**28` elements,
but Wasmtime previously did not check for this limit. This meant that
the guest could get silently corrupt answers when trying to operate on
this many elements. This commit adds a new `ItemCount` newtype wrapper
which is intended to be proof of an in-bounds count and then that's
plumbed everywhere internally.

Closes #13023

* Fix clippy

* Update wit-bindgen dependency

Author: alexcrichton

Cargo.lock

@@ -348,8 +348,8 @@ io-lifetimes = { version = "2.0.3", default-features = false }
 io-extras = "0.18.4"
 rustix = "1.0.8"
 # wit-bindgen:
-wit-bindgen = { version = "0.55.0", default-features = false }
-wit-bindgen-rust-macro = { version = "0.55.0", default-features = false }
+wit-bindgen = { version = "0.56.0", default-features = false }
+wit-bindgen-rust-macro = { version = "0.56.0", default-features = false }
 
 # wasm-tools family:
 wasmparser = { version = "0.246.2", default-features = false, features = ['simd'] }

Cargo.toml

@@ -136,6 +136,8 @@ enum wasmtime_trap_code_enum {
   WASMTIME_TRAP_CODE_CONCURRENT_FUTURE_STREAM_OP = 45,
   /// A reference count (for e.g. an `error-context`) overflowed.
   WASMTIME_TRAP_CODE_REFERENCE_COUNT_OVERFLOW = 46,
+  /// A read/write on a stream must be <2**28 items.
+  WASMTIME_TRAP_CODE_STREAM_OP_TOO_BIG = 47,
 };
 
 /**

crates/c-api/include/wasmtime/trap.h

@@ -53,6 +53,7 @@ const _: () = {
     assert!(Trap::CannotResumeThread as u8 == 44);
     assert!(Trap::ConcurrentFutureStreamOp as u8 == 45);
     assert!(Trap::ReferenceCountOverflow as u8 == 46);
+    assert!(Trap::StreamOpTooBig as u8 == 47);
 };
 
 #[repr(C)]

crates/c-api/src/trap.rs

@@ -223,6 +223,9 @@ generate_trap_type! {
         /// A reference count (for e.g. an `error-context`) overflowed.
         ReferenceCountOverflow = "reference count overflow",
 
+        /// A read/write on a stream must be <2**28 items.
+        StreamOpTooBig = "stream read/write count too large",
+
         // if adding a variant here be sure to update `trap.rs` and `trap.h` as
         // mentioned above
     }