Merge pull request #6718 from paritytech/returndata-bounds-fix

Fixed RETURNDATA out of bounds check
This commit is contained in:
Marek Kotewicz 2017-10-12 15:46:10 +02:00 committed by GitHub
commit 761ba164ee
2 changed files with 28 additions and 1 deletions

View File

@ -574,7 +574,7 @@ impl<Cost: CostType> Interpreter<Cost> {
let source_offset = stack.peek(1); let source_offset = stack.peek(1);
let size = stack.peek(2); let size = stack.peek(2);
let return_data_len = U256::from(self.return_data.len()); let return_data_len = U256::from(self.return_data.len());
if source_offset.overflow_add(*size).0 > return_data_len { if source_offset.saturating_add(*size) > return_data_len {
return Err(vm::Error::OutOfBounds); return Err(vm::Error::OutOfBounds);
} }
} }
@ -940,4 +940,25 @@ mod tests {
assert_eq!(ext.calls.len(), 1); assert_eq!(ext.calls.len(), 1);
assert_eq!(gas_left, 248_212.into()); assert_eq!(gas_left, 248_212.into());
} }
#[test]
fn should_not_overflow_returndata() {
let code = "6001600160000360003e00".from_hex().unwrap();
let mut params = ActionParams::default();
params.address = 5.into();
params.gas = 300_000.into();
params.gas_price = 1.into();
params.code = Some(Arc::new(code));
let mut ext = FakeExt::new_byzantium();
ext.balances.insert(5.into(), 1_000_000_000.into());
ext.tracing = true;
let err = {
let mut vm = Factory::new(VMType::Interpreter, 1).create(params.gas);
test_finalize(vm.exec(params, &mut ext)).err().unwrap()
};
assert_eq!(err, ::vm::Error::OutOfBounds);
}
} }

View File

@ -80,6 +80,12 @@ impl FakeExt {
pub fn new() -> Self { pub fn new() -> Self {
FakeExt::default() FakeExt::default()
} }
pub fn new_byzantium() -> Self {
let mut ext = FakeExt::default();
ext.schedule = Schedule::new_byzantium();
ext
}
} }
impl Ext for FakeExt { impl Ext for FakeExt {