limit array size in SYSCALLs

neo-project · Sep 13, 2018 · 8ba66e5 · 8ba66e5
1 parent 9660630
commit 8ba66e5
Showing 1 changed file with 12 additions and 1 deletion.
diff --git a/neo/SmartContract/StateReader.cs b/neo/SmartContract/StateReader.cs
@@ -773,6 +773,8 @@ protected virtual bool Transaction_GetAttributes(ExecutionEngine engine)
             {
                 Transaction tx = _interface.GetInterface<Transaction>();
                 if (tx == null) return false;
+                if (tx.Attributes.Length > ApplicationEngine.MaxArraySize)
+                    return false;
                 engine.CurrentContext.EvaluationStack.Push(tx.Attributes.Select(p => StackItem.FromInterface(p)).ToArray());
                 return true;
             }
@@ -785,6 +787,8 @@ protected virtual bool Transaction_GetInputs(ExecutionEngine engine)
             {
                 Transaction tx = _interface.GetInterface<Transaction>();
                 if (tx == null) return false;
+                if (tx.Inputs.Length > ApplicationEngine.MaxArraySize)
+                    return false;
                 engine.CurrentContext.EvaluationStack.Push(tx.Inputs.Select(p => StackItem.FromInterface(p)).ToArray());
                 return true;
             }
@@ -797,6 +801,8 @@ protected virtual bool Transaction_GetOutputs(ExecutionEngine engine)
             {
                 Transaction tx = _interface.GetInterface<Transaction>();
                 if (tx == null) return false;
+                if (tx.Outputs.Length > ApplicationEngine.MaxArraySize)
+                    return false;
                 engine.CurrentContext.EvaluationStack.Push(tx.Outputs.Select(p => StackItem.FromInterface(p)).ToArray());
                 return true;
             }
@@ -809,6 +815,8 @@ protected virtual bool Transaction_GetReferences(ExecutionEngine engine)
             {
                 Transaction tx = _interface.GetInterface<Transaction>();
                 if (tx == null) return false;
+                if (tx.Inputs.Length > ApplicationEngine.MaxArraySize)
+                    return false;
                 engine.CurrentContext.EvaluationStack.Push(tx.Inputs.Select(p => StackItem.FromInterface(tx.References[p])).ToArray());
                 return true;
             }
@@ -821,7 +829,10 @@ protected virtual bool Transaction_GetUnspentCoins(ExecutionEngine engine)
             {
                 Transaction tx = _interface.GetInterface<Transaction>();
                 if (tx == null) return false;
-                engine.CurrentContext.EvaluationStack.Push(Blockchain.Default.GetUnspent(tx.Hash).Select(p => StackItem.FromInterface(p)).ToArray());
+                TransactionOutput[] outputs = Blockchain.Default.GetUnspent(tx.Hash).ToArray();
+                if (outputs.Length > ApplicationEngine.MaxArraySize)
+                    return false;
+                engine.CurrentContext.EvaluationStack.Push(outputs.Select(p => StackItem.FromInterface(p)).ToArray());
                 return true;
             }
             return false;