Clip OOB values in call data load and copy (#448)

The OOB logic is implemented in the runtime but truncation circumvented
it.

Closes #263

---------

Signed-off-by: xermicus <cyrill@parity.io>
Signed-off-by: Cyrill Leutwiler <bigcyrill@hotmail.com>
This commit is contained in:
xermicus authored and GitHub committed 2026-01-13 10:15:31 +01:00
1 parent c1ce984ca2
commit a1a4f8e6ea
5 files changed
+68 -12

No files matched your search

@@ -21,12 +21,43 @@ pragma solidity ^0.8.24;
"Instantiated": 0
}
}
},
{
"Call": {
"dest": {
"Instantiated": 0
},
"data": "489eb33e00000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000001a300000000000000000000000000000000000000000000000000000000000000"
}
},
{
"Call": {
"dest": {
"Instantiated": 0
},
"data": "db1ff7bb00000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000001a300000000000000000000000000000000000000000000000000000000000000"
}
}
]
}
*/
contract MemoryBounds {
function oobLoad(bytes memory data) public pure returns (uint256, bytes memory) {
uint256 result1;
assembly {
let ptr := mload(add(data, 0x20))
result1 := calldataload(ptr)
}
return (result1, data);
}
function oobCopy(bytes memory data) public pure returns (uint256, bytes memory) {
assembly {
calldatacopy(0, 0x3a0000000000000000000000000000000000, 0x20)
}
}
fallback() external {
assembly {
// Accessing OOB offsets should always work when the length is 0.