Stack overflow instantiating deeply nested ScVecs, etc.

[brson]

Instantiating deeply-nested ScVecs into the host environment causes stack overflow. Presumably also with maps and UDTs. It is unclear to me whether this is something that a user can trigger by e.g. submitting a specially-crafted transaction.

I am interested in opinions on whether this is something exposed to user input, how to test whether it is exposed to user input, and whether it should be fixed.

What version are you using?

e6e02dc

What did you do?

Run this test case

#[test]
fn deep_vec() -> Result<(), HostError> {
    let host = Host::default();

    let mut v = ScVec::default();
    for _ in 0..1000 {
        let vv = ScVec::try_from(vec![ScVal::from(v)]).unwrap();
        v = vv;
    }

    // stack overflow here
    let _ = host.to_host_val(&ScVal::from(v));

    Ok(())
}

What did you expect to see?

An error.

What did you see instead?

Stack overflow.

[brson]

I think conversion in the opposite direction, from_host_val can also stack overflow.

A guest can trigger these with the put_contract_data and get_contract_data syscalls. Doing so requires a large budget, but someone clever might be able to do it in increments.

Here's a guest-side contract that stack overflows the host with budget turned off:

#[contractimpl]
impl FuzzContract {
    pub fn run(env: Env) {
        use soroban_sdk::{Vec, Symbol};

        let mut v: Vec<RawVal> = Vec::new(&env);
        for _ in 0..10000 {
            let mut vv: Vec<RawVal> = Vec::new(&env);
            vv.push_back(v.into());
            v = vv;
        }

        let key = Symbol::short("key");
        env.storage().set(&key, &v);
        env.storage().get::<_, Vec<RawVal>>(&key);
    }
}

This overflows during the storage().set call, but if that succeeded it would probably also overflow in storage().get

[brson]

I think it's probably possible to stack-overflow the XDR deserializer as well. This looks unboundedly recursive:

impl<T: ReadXdr, const MAX: u32> ReadXdr for VecM<T, MAX> {
    #[cfg(feature = "std")]
    fn read_xdr(r: &mut impl Read) -> Result<Self> {
        let len = u32::read_xdr(r)?;
        if len > MAX {
            return Err(Error::LengthExceedsMax);
        }

        let mut vec = Vec::with_capacity(len as usize);
        for _ in 0..len {
            let t = T::read_xdr(r)?;
            vec.push(t);
        }

        Ok(VecM(vec))
    }
}