mirror of
https://github.com/pezkuwichain/revive.git
synced 2026-10-24 20:55:06 +00:00
Clip OOB values in call data load and copy (#448)
The OOB logic is implemented in the runtime but truncation circumvented it. Closes #263 --------- Signed-off-by: xermicus <cyrill@parity.io> Signed-off-by: Cyrill Leutwiler <bigcyrill@hotmail.com>
This commit is contained in:
1 parent
c1ce984ca2
commit
a1a4f8e6ea
5 files changed
+68
-12
No files matched your search
@@ -1,10 +1,10 @@
|
||||
{
|
||||
"Baseline": 911,
|
||||
"Computation": 2337,
|
||||
"DivisionArithmetics": 14488,
|
||||
"ERC20": 17189,
|
||||
"Events": 1672,
|
||||
"FibonacciIterative": 1454,
|
||||
"Flipper": 2106,
|
||||
"SHA1": 7814
|
||||
"Baseline": 864,
|
||||
"Computation": 2323,
|
||||
"DivisionArithmetics": 14475,
|
||||
"ERC20": 17229,
|
||||
"Events": 1663,
|
||||
"FibonacciIterative": 1421,
|
||||
"Flipper": 2154,
|
||||
"SHA1": 7751
|
||||
}
|
||||
@@ -21,12 +21,43 @@ pragma solidity ^0.8.24;
|
||||
"Instantiated": 0
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"Call": {
|
||||
"dest": {
|
||||
"Instantiated": 0
|
||||
},
|
||||
"data": "489eb33e00000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000001a300000000000000000000000000000000000000000000000000000000000000"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Call": {
|
||||
"dest": {
|
||||
"Instantiated": 0
|
||||
},
|
||||
"data": "db1ff7bb00000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000001a300000000000000000000000000000000000000000000000000000000000000"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
*/
|
||||
|
||||
contract MemoryBounds {
|
||||
function oobLoad(bytes memory data) public pure returns (uint256, bytes memory) {
|
||||
uint256 result1;
|
||||
assembly {
|
||||
let ptr := mload(add(data, 0x20))
|
||||
result1 := calldataload(ptr)
|
||||
}
|
||||
return (result1, data);
|
||||
}
|
||||
|
||||
function oobCopy(bytes memory data) public pure returns (uint256, bytes memory) {
|
||||
assembly {
|
||||
calldatacopy(0, 0x3a0000000000000000000000000000000000, 0x20)
|
||||
}
|
||||
}
|
||||
|
||||
fallback() external {
|
||||
assembly {
|
||||
// Accessing OOB offsets should always work when the length is 0.
|
||||
|
||||
Reference in new issue
Block a user