RightNow-AI/openfang · error · SandboxError
host_log: pointer out of bounds
Error message
host_log: pointer out of bounds
What it means
The guest module called openfang.host_log with (msg_ptr, msg_len) whose byte range falls outside the guest's linear memory. Since host_log requires no capability check, this bounds check is the main safety gate; the host rejects the call rather than reading invalid memory. Like the host_call bounds error, it points at a guest-side pointer/length bug.
Source
Thrown at crates/openfang-runtime/src/sandbox.rs:376
linker
.func_wrap(
"openfang",
"host_log",
|mut caller: Caller<'_, GuestState>,
level: i32,
msg_ptr: i32,
msg_len: i32|
-> Result<(), Error> {
let memory = caller
.get_export("memory")
.and_then(|e| e.into_memory())
.ok_or_else(|| format_err!("no memory export"))?;
let data = memory.data(&caller);
let start = msg_ptr as usize;
let end = start + msg_len as usize;
if end > data.len() {
bail!("host_log: pointer out of bounds");
}
let msg = std::str::from_utf8(&data[start..end]).unwrap_or("<invalid utf8>");
let agent_id = &caller.data().agent_id;
match level {
0 => tracing::trace!(agent = %agent_id, "[wasm] {msg}"),
1 => tracing::debug!(agent = %agent_id, "[wasm] {msg}"),
2 => tracing::info!(agent = %agent_id, "[wasm] {msg}"),
3 => tracing::warn!(agent = %agent_id, "[wasm] {msg}"),
_ => tracing::error!(agent = %agent_id, "[wasm] {msg}"),
}
Ok(())
},
)
.map_err(|e| SandboxError::Compilation(e.to_string()))?;
Ok(())
}View on GitHub (pinned to acf2587e46)
Solutions
- Ensure msg_ptr/msg_len reference a live in-bounds byte buffer: compute msg_len with .len() in bytes on the exact slice you wrote to guest memory
- Verify the buffer was not freed or reallocated between writing it and calling host_log
- Check the pointer/length are i32-safe (no negatives, no overflow when cast to usize inside the host)
- If using a helper library for host logging, update it to the current openfang ABI version
- Temporarily log via a fixed-size static buffer in the guest to isolate whether the allocator or the length computation is at fault
Example fix
// before (guest) let msg = "agent started"; host_log(2, msg.as_ptr() as i32, msg.chars().count() as i32); // after let msg = b"agent started"; host_log(2, msg.as_ptr() as i32, msg.len() as i32);
Defensive patterns
Strategy: validation
Validate before calling
// guest-side, before calling host_log let mem_size = memory.size() * 65536; assert!(msg_ptr >= 0 && msg_len >= 0 && (msg_ptr as usize) + (msg_len as usize) <= mem_size, "log buffer out of bounds");
Type guard
fn log_slice_ok(ptr: i32, len: i32, mem_len: usize) -> bool {
ptr >= 0 && len >= 0 && (ptr as u64) + (len as u64) <= mem_len as u64
} Try / catch
match sandbox.call(&input) {
Err(e) if e.to_string().contains("host_log: pointer out of bounds") => {
eprintln!("guest logging bug: bad msg_ptr/msg_len: {e}");
Err(e)
}
other => other,
} Prevention
- Compute log message lengths in bytes with .len() on a byte slice, not chars().count()
- Write the log message into guest memory immediately before calling host_log
- Wrap host_log in a guest-side helper that does the bounds check once
- Never log from freed or reallocated buffers
- Keep log messages within a fixed, bounded buffer size
When it happens
Trigger: Logging a string whose pointer or length is computed incorrectly (length in chars/elements instead of bytes, off-by-one on the NUL terminator, stale pointer after reallocation), negative i32 pointer, or logging from a buffer allocated by a buggy guest allocator.
Common situations: Passing C strings with strlen computed after moving the buffer; logging a slice of a vector that was freed; guests written in C where char is fine but the wasm32 pointer was truncated; formatting macros writing a longer message than the reserved buffer.
Related errors
AI-assisted analysis of RightNow-AI/openfang@acf2587e46 (2026-09-02).
Data as JSON: /api/errors/02cb78a14e1da8f1.
Report an issue: GitHub.