  WebAssembly is increasingly used as the compilation target for cross-platform
applications. In this paper, we investigate whether one can rely on the
security measures enforced by existing C compilers when compiling C programs to
WebAssembly. We compiled 4,469 C programs with known buffer overflow
vulnerabilities to x86 code and to WebAssembly, and observed the outcome of the
execution of the generated code to differ for 1,088 programs. Through manual
inspection, we identified that the root cause for these is the lack of security
measures such as stack canaries in the generated WebAssembly: while x86 code
crashes upon a stack-based buffer overflow, the corresponding WebAssembly
continues to be executed. We conclude that compiling an existing C program to
WebAssembly without additional precautions may hamper its security, and we
encourage more research in this direction.
