Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: per-method calldatasize checks #2911

Merged
merged 10 commits into from
Jun 17, 2022

Conversation

tserg
Copy link
Collaborator

@tserg tserg commented Jun 16, 2022

What I did

Fix #1730.

How I did it

Add a clamper for calldata to be at least of minimum ABI size + 4 bytes for method ID.

How to verify it

See additional tests.

Commit message

fix: ensure calldata is of minimum length

Added a clamper to calldata to ensure its length is at least 
equal to or greater than the minimum ABI size + 4 bytes for
method ID.

Fix #1730.

Description for the changelog

Ensure calldata is at least of minimum length.

Cute Animal Picture

Put a link to a cute animal picture inside the parenthesis-->

@codecov-commenter
Copy link

codecov-commenter commented Jun 16, 2022

Codecov Report

Merging #2911 (f71d911) into master (2adc34f) will decrease coverage by 0.02%.
The diff coverage is 100.00%.

❗ Current head f71d911 differs from pull request most recent head aa860a8. Consider uploading reports for the commit aa860a8 to get more accurate results

@@            Coverage Diff             @@
##           master    #2911      +/-   ##
==========================================
- Coverage   88.19%   88.17%   -0.03%     
==========================================
  Files          95       95              
  Lines       10575    10584       +9     
  Branches     2532     2534       +2     
==========================================
+ Hits         9327     9332       +5     
- Misses        790      792       +2     
- Partials      458      460       +2     
Impacted Files Coverage Δ
.../codegen/function_definitions/external_function.py 100.00% <100.00%> (ø)
vyper/codegen/ir_node.py 91.04% <0.00%> (-0.75%) ⬇️
vyper/codegen/core.py 84.20% <0.00%> (-0.39%) ⬇️
vyper/codegen/expr.py 79.43% <0.00%> (ø)
vyper/codegen/abi_encoder.py 86.66% <0.00%> (ø)
vyper/builtin_functions/convert.py 90.60% <0.00%> (+0.14%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2adc34f...aa860a8. Read the comment docs.

vyper/codegen/function_definitions/external_function.py Outdated Show resolved Hide resolved
@@ -2452,3 +2452,74 @@ def do_stuff(f: Foo) -> uint256:
c2 = get_contract(callee_code)

assert c1.do_stuff(c2.address) == 1


def test_calldata_clamp(get_contract, assert_tx_failed):
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also need a test for calldata exceeding the expected length in the case of static data.

side note -- i think these tests might be clearer if the malformed data is prepared in python.

tserg and others added 5 commits June 16, 2022 18:03

@pytest.mark.parametrize(
"typ,val",
[("address", TEST_ADDR), ("uint256", 2 ** 256 - 1), ("int128", 2 ** 127 - 1), ("bool", True)],
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i'm not sure it's necessary to test non-address types here. all we care about is the size of calldata, so we can just test a single type. (the uint256 case would fail for other reasons, namely that the data is OOB for address type)

Suggested change
[("address", TEST_ADDR), ("uint256", 2 ** 256 - 1), ("int128", 2 ** 127 - 1), ("bool", True)],
[("address", TEST_ADDR)],
Suggested change
[("address", TEST_ADDR), ("uint256", 2 ** 256 - 1), ("int128", 2 ** 127 - 1), ("bool", True)],
[("address", TEST_ADDR), ("uint256", 2 ** 256 - 1), ("int128", 2 ** 127 - 1), ("bool", True)],


@pytest.mark.parametrize(
"typ,val",
[("address", TEST_ADDR), ("uint256", 2 ** 256 - 1), ("int128", 2 ** 127 - 1), ("bool", True)],
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i'm not sure it's necessary to test non-address types here. all we care about is the size of calldata, so we can just test a single type. (the uint256 case would fail for other reasons, namely that the data is OOB for address type)

Suggested change
[("address", TEST_ADDR), ("uint256", 2 ** 256 - 1), ("int128", 2 ** 127 - 1), ("bool", True)],
[("address", TEST_ADDR)],
Suggested change
[("address", TEST_ADDR), ("uint256", 2 ** 256 - 1), ("int128", 2 ** 127 - 1), ("bool", True)],
[("address", TEST_ADDR), ("uint256", 2 ** 256 - 1), ("int128", 2 ** 127 - 1), ("bool", True)],

@charles-cooper charles-cooper changed the title fix: ensure calldata is of minimum length fix: per-method calldatasize checks Jun 16, 2022
Copy link
Member

@charles-cooper charles-cooper left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm. thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

verify calldata length
3 participants