mirror of
https://github.com/ethereum/go-ethereum.git
synced 2026-02-26 07:37:20 +00:00
core/vm: fix EIP-7823 modexp input length check (#32363)
The order of the checks was wrong which would have allowed a call to modexp with `baseLen == 0 && modLen == 0` post fusaka. Also handles an edge case where base/mod/exp length >= 2**64 --------- Co-authored-by: Felix Lange <fjl@twurst.com>
This commit is contained in:
parent
1693a48f8c
commit
a9a19c4202
1 changed files with 12 additions and 7 deletions
|
|
@ -501,23 +501,28 @@ func (c *bigModExp) RequiredGas(input []byte) uint64 {
|
|||
|
||||
func (c *bigModExp) Run(input []byte) ([]byte, error) {
|
||||
var (
|
||||
baseLen = new(big.Int).SetBytes(getData(input, 0, 32)).Uint64()
|
||||
expLen = new(big.Int).SetBytes(getData(input, 32, 32)).Uint64()
|
||||
modLen = new(big.Int).SetBytes(getData(input, 64, 32)).Uint64()
|
||||
baseLenBig = new(big.Int).SetBytes(getData(input, 0, 32))
|
||||
expLenBig = new(big.Int).SetBytes(getData(input, 32, 32))
|
||||
modLenBig = new(big.Int).SetBytes(getData(input, 64, 32))
|
||||
baseLen = baseLenBig.Uint64()
|
||||
expLen = expLenBig.Uint64()
|
||||
modLen = modLenBig.Uint64()
|
||||
inputLenOverflow = max(baseLenBig.BitLen(), expLenBig.BitLen(), modLenBig.BitLen()) > 64
|
||||
)
|
||||
if len(input) > 96 {
|
||||
input = input[96:]
|
||||
} else {
|
||||
input = input[:0]
|
||||
}
|
||||
|
||||
// enforce size cap for inputs
|
||||
if c.eip7823 && (inputLenOverflow || max(baseLen, expLen, modLen) > 1024) {
|
||||
return nil, errors.New("one or more of base/exponent/modulus length exceeded 1024 bytes")
|
||||
}
|
||||
// Handle a special case when both the base and mod length is zero
|
||||
if baseLen == 0 && modLen == 0 {
|
||||
return []byte{}, nil
|
||||
}
|
||||
// enforce size cap for inputs
|
||||
if c.eip7823 && max(baseLen, expLen, modLen) > 1024 {
|
||||
return nil, errors.New("one or more of base/exponent/modulus length exceeded 1024 bytes")
|
||||
}
|
||||
// Retrieve the operands and execute the exponentiation
|
||||
var (
|
||||
base = new(big.Int).SetBytes(getData(input, 0, baseLen))
|
||||
|
|
|
|||
Loading…
Reference in a new issue