Skip to content

Commit

Permalink
Changelog and test for the KeccakCaching bug
Browse files Browse the repository at this point in the history
  • Loading branch information
hrkrshnn committed Mar 22, 2021
1 parent e299117 commit 97593f6
Show file tree
Hide file tree
Showing 9 changed files with 155 additions and 13 deletions.
1 change: 1 addition & 0 deletions Changelog.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ Bugfixes:
* SMTChecker: Fix internal error on calling public getter on a state variable of type array (possibly nested) of structs.
* SMTChecker: Fix internal error on pushing to ``string`` casted to ``bytes``.
* SMTChecker: Fix bug in virtual functions called by constructors.
* Optimizer: Fix bug on incorrect caching of keccak256 hashes.

AST Changes:
* ModifierInvocation: Add ``kind`` field which can be ``modifierInvocation`` or ``baseConstructorSpecifier``.
Expand Down
7 changes: 7 additions & 0 deletions docs/bugs.json
Original file line number Diff line number Diff line change
@@ -1,4 +1,11 @@
[
{
"name": "KeccakCaching",
"summary": "The bytecode optimizer incorrectly evaluated certain keccak256 hashes. You are unlikely to be affected if you do not compute keccak256 hashes in inline assembly.",
"description": "Solidity's bytecode optimizer has a step that can compute keccak256 hashes, if the contents of the memory are known during compilation time. This step also had a mechanism to determine that two keccak256 hashes are equal even if the values in memory are not known during compile time. This mechanism had a bug where, keccak256 of the same memory location, but different sizes were considered equal. More specifically, ``keccak256(mpos, length1)`` and ``keccak256(mpos, length2)`` in some cases were considered equal when ``length1`` and ``length2``, when rounded up to nearest multiple of 32 were the same. You maybe affected if you compute keccak256 hashes from the same memory location, but different lengths in inline assembly and enabled the optimizer.",
"fixed": "0.8.3",
"severity": "medium"
},
{
"name": "EmptyByteArrayCopy",
"summary": "Copying an empty byte array (or string) from memory or calldata to storage can result in data corruption if the target array's length is increased subsequently without storing new data.",
Expand Down

0 comments on commit 97593f6

Please sign in to comment.