Clip OOB values in call data load and copy (#448)

The OOB logic is implemented in the runtime but truncation circumvented
it.

Closes #263

---------

Signed-off-by: xermicus <cyrill@parity.io>
Signed-off-by: Cyrill Leutwiler <bigcyrill@hotmail.com>
This commit is contained in:
xermicus authored and GitHub committed 2026-01-13 10:15:31 +01:00
1 parent c1ce984ca2
commit a1a4f8e6ea
5 files changed
+68 -12

No files matched your search

+8 -8
View File
@@ -1,10 +1,10 @@
{
"Baseline": 911,
"Computation": 2337,
"DivisionArithmetics": 14488,
"ERC20": 17189,
"Events": 1672,
"FibonacciIterative": 1454,
"Flipper": 2106,
"SHA1": 7814
"Baseline": 864,
"Computation": 2323,
"DivisionArithmetics": 14475,
"ERC20": 17229,
"Events": 1663,
"FibonacciIterative": 1421,
"Flipper": 2154,
"SHA1": 7751
}
@@ -21,12 +21,43 @@ pragma solidity ^0.8.24;
"Instantiated": 0
}
}
},
{
"Call": {
"dest": {
"Instantiated": 0
},
"data": "489eb33e00000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000001a300000000000000000000000000000000000000000000000000000000000000"
}
},
{
"Call": {
"dest": {
"Instantiated": 0
},
"data": "db1ff7bb00000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000001a300000000000000000000000000000000000000000000000000000000000000"
}
}
]
}
*/
contract MemoryBounds {
function oobLoad(bytes memory data) public pure returns (uint256, bytes memory) {
uint256 result1;
assembly {
let ptr := mload(add(data, 0x20))
result1 := calldataload(ptr)
}
return (result1, data);
}
function oobCopy(bytes memory data) public pure returns (uint256, bytes memory) {
assembly {
calldatacopy(0, 0x3a0000000000000000000000000000000000, 0x20)
}
}
fallback() external {
assembly {
// Accessing OOB offsets should always work when the length is 0.