mirror of
https://github.com/pezkuwichain/revive.git
synced 2026-10-26 13:39:52 +00:00
Clip OOB values in call data load and copy (#448)
The OOB logic is implemented in the runtime but truncation circumvented it. Closes #263 --------- Signed-off-by: xermicus <cyrill@parity.io> Signed-off-by: Cyrill Leutwiler <bigcyrill@hotmail.com>
This commit is contained in:
1 parent
c1ce984ca2
commit
a1a4f8e6ea
5 files changed
+68
-12
No files matched your search
@@ -21,12 +21,43 @@ pragma solidity ^0.8.24;
|
||||
"Instantiated": 0
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"Call": {
|
||||
"dest": {
|
||||
"Instantiated": 0
|
||||
},
|
||||
"data": "489eb33e00000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000001a300000000000000000000000000000000000000000000000000000000000000"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Call": {
|
||||
"dest": {
|
||||
"Instantiated": 0
|
||||
},
|
||||
"data": "db1ff7bb00000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000001a300000000000000000000000000000000000000000000000000000000000000"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
*/
|
||||
|
||||
contract MemoryBounds {
|
||||
function oobLoad(bytes memory data) public pure returns (uint256, bytes memory) {
|
||||
uint256 result1;
|
||||
assembly {
|
||||
let ptr := mload(add(data, 0x20))
|
||||
result1 := calldataload(ptr)
|
||||
}
|
||||
return (result1, data);
|
||||
}
|
||||
|
||||
function oobCopy(bytes memory data) public pure returns (uint256, bytes memory) {
|
||||
assembly {
|
||||
calldatacopy(0, 0x3a0000000000000000000000000000000000, 0x20)
|
||||
}
|
||||
}
|
||||
|
||||
fallback() external {
|
||||
assembly {
|
||||
// Accessing OOB offsets should always work when the length is 0.
|
||||
|
||||
Reference in new issue
Block a user