Skip to content

Commit

Permalink
Stricter input legth checking in precompiles getValidator/fractionMul…
Browse files Browse the repository at this point in the history
…Exps/transfer (#2038)

* fractionMulExp: stricter input length check

See #615

* transfer: stricter input length checking

See #615

* getValidator: stricter input length checking

See #615

* Only change precompile checks after GFork
  • Loading branch information
karlb authored Apr 25, 2023
1 parent 865c73e commit ebe6ae7
Show file tree
Hide file tree
Showing 4 changed files with 22 additions and 7 deletions.
6 changes: 3 additions & 3 deletions core/vm/contracts.go
Original file line number Diff line number Diff line change
Expand Up @@ -698,7 +698,7 @@ func (c *transfer) Run(input []byte, caller common.Address, evm *EVM) ([]byte, e
// to: 32 bytes representing the address of the recipient
// value: 32 bytes, a 256 bit integer representing the amount of Celo Gold to transfer
// 3 arguments x 32 bytes each = 96 bytes total input
if len(input) < 96 {
if (evm.chainRules.IsGFork && len(input) != 96) || len(input) <= 96 {
return nil, ErrInputLength
}

Expand Down Expand Up @@ -781,7 +781,7 @@ func (c *fractionMulExp) Run(input []byte, caller common.Address, evm *EVM) ([]b
// decimals: 32 bytes, 256 bit integer, places of precision
//
// 6 args x 32 bytes each = 192 bytes total input length
if len(input) < 192 {
if (evm.chainRules.IsGFork && len(input) != 192) || len(input) < 192 {
return nil, ErrInputLength
}

Expand Down Expand Up @@ -1015,7 +1015,7 @@ func (c *getValidator) Run(input []byte, caller common.Address, evm *EVM) ([]byt
// input is comprised of two arguments:
// index: 32 byte integer representing the index of the validator to get
// blockNumber: 32 byte integer representing the block number to access
if len(input) < 64 {
if (evm.chainRules.IsGFork && len(input) != 64) || len(input) < 64 {
return nil, ErrInputLength
}

Expand Down
9 changes: 8 additions & 1 deletion core/vm/contracts_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -499,7 +499,14 @@ func BenchmarkPrecompiledEd25519Verify(b *testing.B) { benchJSON("ed25519Verify"

// Tests sample inputs for fractionMulExp
// NOTE: This currently only verifies that inputs of invalid length are rejected
func TestPrecompiledFractionMulExp(t *testing.T) { testJSON("fractionMulExp", "fc", t) }
func TestPrecompiledFractionMulExp(t *testing.T) {
// Post GFork behaviour
mockEVM.chainRules.IsGFork = true
testJSON("fractionMulExp", "fc", t)
// Pre GFork behaviour
mockEVM.chainRules.IsGFork = false
testJSON("fractionMulExpOld", "fc", t)
}

// Tests sample inputs for proofOfPossession
// NOTE: This currently only verifies that inputs of invalid length are rejected
Expand Down
7 changes: 4 additions & 3 deletions core/vm/testdata/precompiles/fractionMulExp.json
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,14 @@
},
{
"Input": "0000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000001200000000000000000000000000000000000000000000000000000000000000150000000000000000000000000000000000000000000000000000000000000f100000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000400000000",
"Expected": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002710",
"Name": "input_too_long"
"Expected": "invalid input length",
"Name": "input_too_long",
"ErrorExpected": true
},
{
"Input": "",
"Expected": "invalid input length",
"Name": "empty_input",
"ErrorExpected": true
}
]
]
7 changes: 7 additions & 0 deletions core/vm/testdata/precompiles/fractionMulExpOld.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
[
{
"Input": "0000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000001200000000000000000000000000000000000000000000000000000000000000150000000000000000000000000000000000000000000000000000000000000f100000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000400000000",
"Expected": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002710",
"Name": "input_too_long"
}
]

0 comments on commit ebe6ae7

Please sign in to comment.