forks/go-ethereum
1
0
Fork 1
mirror of https://github.com/ethereum/go-ethereum.git synced 2026-08-19 02:12:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

core/vm: fix fuzzing found error, where RJUMP overwrites stack bounds

Browse source
This commit is contained in:
Marius van der Wijden 2024-08-30 12:00:22 +02:00
parent 2537d43008
commit a7953691df
1 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
core/vm/validate_linear.go
View file

@ -15,7 +15,7 @@ func validateControlFlow2(code []byte, section int, metadata []*FunctionMetadata
var ( var (
stackBounds = make(map[int]*bounds) stackBounds = make(map[int]*bounds)
maxStackHeight = int(metadata[section].Input) maxStackHeight = int(metadata[section].Input)
debugging = !true debugging = true
) )
setBounds := func(pos, min, maxi int) *bounds { setBounds := func(pos, min, maxi int) *bounds {
@ -118,7 +118,7 @@ func validateControlFlow2(code []byte, section int, metadata []*FunctionMetadata
nextPos := pos + 2 + parseInt16(code[pos+1:]) nextPos := pos + 2 + parseInt16(code[pos+1:])
next = append(next, nextPos) next = append(next, nextPos)
// We set the stack bounds of the destination // We set the stack bounds of the destination
// and skip the argument // and skip the argument, only for RJUMP, all other opcodes are handled later
if nextPos+1 < pos { if nextPos+1 < pos {
nextBounds, ok := stackBounds[nextPos+1] nextBounds, ok := stackBounds[nextPos+1]
if !ok { if !ok {
@ -128,7 +128,12 @@ func validateControlFlow2(code []byte, section int, metadata []*FunctionMetadata
return 0, ErrInvalidMaxStackHeight return 0, ErrInvalidMaxStackHeight
} }
} }
setBounds(next[0]+1, currentStackMin, currentStackMax) nextBounds, ok := stackBounds[nextPos+1]
if !ok {
setBounds(nextPos+1, currentStackMin, currentStackMax)
} else {
setBounds(nextPos+1, min(nextBounds.min, currentStackMin), max(nextBounds.max, currentStackMax))
}
case RJUMPI: case RJUMPI:
arg := parseInt16(code[pos+1:]) arg := parseInt16(code[pos+1:])
next = append(next, pos+2) next = append(next, pos+2)