Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing array index OOB check #877

Open
g-r-a-n-t opened this issue Apr 21, 2023 · 0 comments
Open

Missing array index OOB check #877

g-r-a-n-t opened this issue Apr 21, 2023 · 0 comments
Labels
comp: analyzer Everything that involves the analyzer pass type: bug

Comments

@g-r-a-n-t
Copy link
Member

What is wrong?

See the following code:

// The following tests does not pass due absent runtime check.
// Obviously this couild also be a compile-time check.
//
// contract ArrayIndexOobStatic {
// pub unsafe fn __call__() {
// let mut my_array: Array<u256, 4> = [0, 1, 2, 3]
// evm::sstore(offset: 0, value: my_array[26])
// }
// }
// #test
// unsafe fn test_array_oob_static() {
// let mut ctx: Context = Context()
// let array_index_oob: ArrayIndexOobStatic = ArrayIndexOobStatic.create(ctx, value: 0)
// let expected_revert_data: Array<u8, 36> = [78, 72, 123, 113, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 50]
// // verify that the call reverts
// assert evm::call(
// gas: CALL_GAS,
// addr: address(array_index_oob),
// value: 0,
// input_offset: 0,
// input_len: 0,
// output_offset: FREE_MEM_PTR,
// output_len: 36
// ) == 0
// // check the revert data
// let mut offset: u256 = FREE_MEM_PTR
// for expected_byte in expected_revert_data {
// assert evm::shr(248, evm::mload(offset)) == expected_byte
// offset += 1
// }
// }

How can it be fixed

Add a compile-time check for array indices.

@g-r-a-n-t g-r-a-n-t added type: bug comp: analyzer Everything that involves the analyzer pass labels Apr 22, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
comp: analyzer Everything that involves the analyzer pass type: bug
Projects
None yet
Development

No branches or pull requests

1 participant