mirror of
https://github.com/pezkuwichain/revive.git
synced 2026-10-20 18:56:17 +00:00
xermicusandClaude Opus 4.8
e2e6514953
Bug found by @jubnzv: `--newyork`: dead-store elimination could drop a store whose memory expansion an intervening `msize()` observes, so `msize()` read a stale (unexpanded) value. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
25 lines
1.1 KiB
Plaintext
25 lines
1.1 KiB
Plaintext
/// Soundness PoC (newyork dead-store elimination vs `msize`): a store whose
|
|
/// memory expansion an intervening `msize()` observes must not be eliminated as
|
|
/// dead by a later overwrite.
|
|
///
|
|
/// `mstore(288, 1)` writes `[288, 320)`, expanding active memory to `0x140`.
|
|
/// `msize()` between the two stores must observe that expansion (`0x140`). The
|
|
/// dead-store pass dropped the first store because `mstore(288, 2)` overwrites
|
|
/// the same offset — but that moved the expansion to *after* the `msize()`, so
|
|
/// `msize()` read the smaller (unexpanded) value `0`. EVM (and the stock
|
|
/// pipeline) return `0x140`. The fix clears the dead-store candidate set when an
|
|
/// `msize()` is evaluated, since it observes the cumulative memory expansion of
|
|
/// all prior stores.
|
|
object "MsizeDseBug" {
|
|
code { datacopy(0, dataoffset("MsizeDseBug_deployed"), datasize("MsizeDseBug_deployed")) return(0, datasize("MsizeDseBug_deployed")) }
|
|
object "MsizeDseBug_deployed" {
|
|
code {
|
|
mstore(288, 1)
|
|
let r := msize()
|
|
mstore(288, 2)
|
|
mstore(0, r)
|
|
return(0, 32)
|
|
}
|
|
}
|
|
}
|