[crash/fuzzing] "IndexOutOfBoundsException: index (-1) must not be negative" during block ssz parsing

[pventuzelo]

Description

During fuzzing with beacon-fuzz, I triggered an java.lang.IndexOutOfBoundsException: index (-1) must not be negative during block SSZ parsing using teku transition blocks tool.

Bug occurs because numBytes is equal to 0 when bytes.get(numBytes - 1) at line 115.

Additional info

Other eth2 clients detects this exception and returns:

• lighthouse: Ssz decode failed: OutOfBoundsByte { i: 0 }
• nim: SszSizeMismatchError

Related code:

https://github.com/PegaSysEng/teku/blob/c6e8e56b7a0edc078a88d1b40587262d22bd4c0a/ssz/src/main/java/tech/pegasys/artemis/ssz/SSZTypes/Bitlist.java#L112-L117

Steps to Reproduce (Bug)

• Download: index_negative_outofbound_teku.zip

• Crash:

# install
./gradlew distTar installDist

# go to build folder
cd build/install/

# Run teku
bin/teku transition blocks --pre=index_negative_outofbound_state_teku.ssz --network=mainnet index_negative_outofbound_block_teku.ssz
java.lang.IndexOutOfBoundsException: index (-1) must not be negative
	at com.google.common.base.Preconditions.checkElementIndex(Preconditions.java:1345)
	at com.google.common.base.Preconditions.checkElementIndex(Preconditions.java:1327)
	at org.apache.tuweni.bytes.ArrayWrappingBytes.get(ArrayWrappingBytes.java:60)
	at tech.pegasys.artemis.ssz.SSZTypes.Bitlist.fromBytes(Bitlist.java:115)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeBitlist(SimpleOffsetSerializer.java:372)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeVariableParts(SimpleOffsetSerializer.java:340)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeContainer(SimpleOffsetSerializer.java:229)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeVariableElementList(SimpleOffsetSerializer.java:404)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeVariableParts(SimpleOffsetSerializer.java:334)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeContainer(SimpleOffsetSerializer.java:229)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeVariableParts(SimpleOffsetSerializer.java:348)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeContainer(SimpleOffsetSerializer.java:229)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeVariableParts(SimpleOffsetSerializer.java:348)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeContainer(SimpleOffsetSerializer.java:229)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeContainerErrorWrapper(SimpleOffsetSerializer.java:205)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.lambda$deserialize$1(SimpleOffsetSerializer.java:196)
	at org.apache.tuweni.ssz.SSZ.decode(SSZ.java:1255)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserialize(SimpleOffsetSerializer.java:194)
	at tech.pegasys.artemis.cli.subcommand.TransitionCommand.readBlock(TransitionCommand.java:158)
	at tech.pegasys.artemis.cli.subcommand.TransitionCommand.lambda$blocks$0(TransitionCommand.java:81)
	at tech.pegasys.artemis.cli.subcommand.TransitionCommand.processStateTransition(TransitionCommand.java:131)
	at tech.pegasys.artemis.cli.subcommand.TransitionCommand.blocks(TransitionCommand.java:76)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at picocli.CommandLine.executeUserObject(CommandLine.java:1802)
	at picocli.CommandLine.access$900(CommandLine.java:145)
	at picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2150)
	at picocli.CommandLine$RunLast.handle(CommandLine.java:2144)
	at picocli.CommandLine$RunLast.handle(CommandLine.java:2108)
	at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:1975)
	at picocli.CommandLine.execute(CommandLine.java:1904)
	at tech.pegasys.artemis.cli.BeaconNodeCommand.parse(BeaconNodeCommand.java:185)
	at tech.pegasys.artemis.Artemis.main(Artemis.java:31)

Versions

• Github branch: master
• Github commit: 1cc3466
• Java version: openjdk version "11.0.7" 2020-04-14
• OS Name & Version: Ubuntu 18.04.4 LTS
• Kernel Version: 4.15.0-96-generic