## Environments

**OS** : Ubuntu 18.04 5.4.0-150-generic
**Commit** : e97d53c5fcbb604fc36432df4fc117d13558d7fd
**Version** : 1.0.34

## Vulnerability Description

**Affected Tool** : wasm-decompile
**Affected Version** : <= 1.0.34
**Impact** : Denial of Service

* The assertion '!empty()' fail in /include/wabt/intrusive-list.h in wabt 1.0.34 can cause a denial of service(assertion failure) via a crafted wasm file.

## PoC
**1. Input File**

[wasm-decompile-DOS-poc01.zip](https://github.com/WebAssembly/wabt/files/13198250/wasm-decompile-DOS-poc01.zip)

**2. Reproduce**

```shell
$ ~/wabt/bin/wasm-decompile wasm-decompile-DOS-poc01
```

**3. Stack Trace**

```shell
$ ~/wabt/bin/wasm-decompile wasm-decompile-DOS-poc01
wasm-decompile: ../../../../include/wabt/intrusive-list.h:394: typename intrusive_list<T>::const_reference wabt::intrusive_list<wabt::Expr>::front() const [T = wabt::Expr]: Assertion `!empty()' failed.
Aborted
```
wasm-decompile: Assertion `!empty()' failure cause DoS
This is a GitHub Issue
repo:wabt
owner:WebAssembly
Title : wasm-decompile: Assertion `!empty()' failure cause DoS
Issue date:

--- start body ---
## Environments

**OS** : Ubuntu 18.04 5.4.0-150-generic
**Commit** : e97d53c5fcbb604fc36432df4fc117d13558d7fd
**Version** : 1.0.34

## Vulnerability Description

**Affected Tool** : wasm-decompile
**Affected Version** : <= 1.0.34
**Impact** : Denial of Service

* The assertion '!empty()' fail in /include/wabt/intrusive-list.h in wabt 1.0.34 can cause a denial of service(assertion failure) via a crafted wasm file.

## PoC
**1. Input File**

[wasm-decompile-DOS-poc01.zip](https://github.com/WebAssembly/wabt/files/13198250/wasm-decompile-DOS-poc01.zip)

**2. Reproduce**

```shell
$ ~/wabt/bin/wasm-decompile wasm-decompile-DOS-poc01
```

**3. Stack Trace**

```shell
$ ~/wabt/bin/wasm-decompile wasm-decompile-DOS-poc01
wasm-decompile: ../../../../include/wabt/intrusive-list.h:394: typename intrusive_list<T>::const_reference wabt::intrusive_list<wabt::Expr>::front() const [T = wabt::Expr]: Assertion `!empty()' failed.
Aborted
```
--- end body ---

The wasm-decompile tool in wabt version 1.0.34 has a vulnerability that allows an attacker to cause a Denial of Service (DoS) by triggering an assertion failure through a specially crafted WebAssembly (wasm) file. The assertion `!empty()` fails when the tool attempts to access the front of an empty intrusive list, leading to an abort of the program.