cerc-io/solidity
11
0
Fork 0
mirror of https://github.com/ethereum/solidity synced 2023-10-03 13:03:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Added overflow checks after multiplication operation is executed.

Browse Source
This commit is contained in:
Matheus Aguiar
2022-08-12 10:18:05 -03:00
parent c48be40ab8
commit 2282ea5e56
21 changed files with 243 additions and 104 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/formal/checked_int_mul_12.py
+46
View File
@@ -0,0 +1,46 @@
from opcodes import AND, SDIV, MUL, EQ, ISZERO, OR, SLT
from rule import Rule
from util import BVSignedUpCast, BVSignedMin, BVSignedCleanupFunction
from z3 import BVMulNoOverflow, BVMulNoUnderflow, BitVec, Not, Or
"""
Overflow checked signed integer multiplication.
"""
# Approximation with 16-bit base types.
n_bits = 12
for type_bits in [4, 6, 8, 12]:
rule = Rule()
# Input vars
X_short = BitVec('X', type_bits)
Y_short = BitVec('Y', type_bits)
# Z3's overflow and underflow conditions
actual_overflow = Not(BVMulNoOverflow(X_short, Y_short, True))
actual_underflow = Not(BVMulNoUnderflow(X_short, Y_short))
# cast to full n_bits values
X = BVSignedUpCast(X_short, n_bits)
Y = BVSignedUpCast(Y_short, n_bits)
product_raw = MUL(X, Y)
#remove any overflown bits
product = BVSignedCleanupFunction(product_raw, type_bits)
# Constants
min_value = BVSignedMin(type_bits, n_bits)
# Overflow and underflow checks in YulUtilFunction::overflowCheckedIntMulFunction
if type_bits > n_bits / 2:
sol_overflow_check_1 = ISZERO(OR(ISZERO(X), EQ(Y, SDIV(product, X))))
if type_bits == n_bits:
sol_overflow_check_2 = AND(SLT(X, 0), EQ(Y, min_value))
sol_overflow_check = Or(sol_overflow_check_1 != 0, sol_overflow_check_2 != 0)
else:
sol_overflow_check = (sol_overflow_check_1 != 0)
else:
sol_overflow_check = (ISZERO(EQ(product, product_raw)) != 0)
rule.check(Or(actual_overflow, actual_underflow), sol_overflow_check)
test/formal/checked_int_mul_16.py
-43
View File
@@ -1,43 +0,0 @@
from opcodes import AND, DIV, GT, SDIV, SGT, SLT
from rule import Rule
from util import BVSignedMax, BVSignedMin, BVSignedUpCast
from z3 import BVMulNoOverflow, BVMulNoUnderflow, BitVec, Not, Or
"""
Overflow checked signed integer multiplication.
"""
# Approximation with 16-bit base types.
n_bits = 16
type_bits = 8
while type_bits <= n_bits:
rule = Rule()
# Input vars
X_short = BitVec('X', type_bits)
Y_short = BitVec('Y', type_bits)
# Z3's overflow and underflow conditions
actual_overflow = Not(BVMulNoOverflow(X_short, Y_short, True))
actual_underflow = Not(BVMulNoUnderflow(X_short, Y_short))
# cast to full n_bits values
X = BVSignedUpCast(X_short, n_bits)
Y = BVSignedUpCast(Y_short, n_bits)
# Constants
maxValue = BVSignedMax(type_bits, n_bits)
minValue = BVSignedMin(type_bits, n_bits)
# Overflow and underflow checks in YulUtilFunction::overflowCheckedIntMulFunction
overflow_check_1 = AND(AND(SGT(X, 0), SGT(Y, 0)), GT(X, DIV(maxValue, Y)))
underflow_check_1 = AND(AND(SGT(X, 0), SLT(Y, 0)), SLT(Y, SDIV(minValue, X)))
underflow_check_2 = AND(AND(SLT(X, 0), SGT(Y, 0)), SLT(X, SDIV(minValue, Y)))
overflow_check_2 = AND(AND(SLT(X, 0), SLT(Y, 0)), SLT(X, SDIV(maxValue, Y)))
rule.check(actual_overflow, Or(overflow_check_1 != 0, overflow_check_2 != 0))
rule.check(actual_underflow, Or(underflow_check_1 != 0, underflow_check_2 != 0))
type_bits *= 2
test/formal/checked_uint_mul_16.py → test/formal/checked_uint_mul_12.py
+12 -12
View File
@@ -1,6 +1,6 @@
from opcodes import AND, ISZERO, GT, DIV
from opcodes import ISZERO, DIV, MUL, EQ, OR
from rule import Rule
from util import BVUnsignedUpCast, BVUnsignedMax
from util import BVUnsignedUpCast, BVUnsignedCleanupFunction
from z3 import BitVec, Not, BVMulNoOverflow
"""
@@ -8,10 +8,9 @@ Overflow checked unsigned integer multiplication.
"""
# Approximation with 16-bit base types.
n_bits = 16
type_bits = 8
n_bits = 12
while type_bits <= n_bits:
for type_bits in [4, 6, 8, 12]:
rule = Rule()
@@ -25,13 +24,14 @@ while type_bits <= n_bits:
# cast to full n_bits values
X = BVUnsignedUpCast(X_short, n_bits)
Y = BVUnsignedUpCast(Y_short, n_bits)
product_raw = MUL(X, Y)
#remove any overflown bits
product = BVUnsignedCleanupFunction(product_raw, type_bits)
# Constants
maxValue = BVUnsignedMax(type_bits, n_bits)
# Overflow check in YulUtilFunction::overflowCheckedIntMulFunction
overflow_check = AND(ISZERO(ISZERO(X)), GT(Y, DIV(maxValue, X)))
# Overflow check in YulUtilFunction::overflowCheckedIntMulFunctions
if type_bits > n_bits / 2:
overflow_check = ISZERO(OR(ISZERO(X), EQ(Y, DIV(product, X))))
else:
overflow_check = ISZERO(EQ(product, product_raw))
rule.check(overflow_check != 0, actual_overflow)
type_bits *= 2
test/formal/signed_integer_cleanup_function.py
+41
View File
@@ -0,0 +1,41 @@
from opcodes import SIGNEXTEND
from rule import Rule
from util import BVSignedCleanupFunction, BVSignedUpCast
from z3 import BitVec, BitVecVal, Concat
"""
Overflow checked signed integer multiplication.
"""
n_bits = 256
# Check that YulUtilFunction::cleanupFunction cleanup matches BVSignedCleanupFunction
for type_bits in range(8,256,8):
rule = Rule()
# Input vars
X = BitVec('X', n_bits)
arg = BitVecVal(type_bits / 8 - 1, n_bits)
cleaned_reference = BVSignedCleanupFunction(X, type_bits)
cleaned = SIGNEXTEND(arg, X)
rule.check(cleaned, cleaned_reference)
# Check that BVSignedCleanupFunction properly cleans up values.
for type_bits in range(8,256,8):
rule = Rule()
# Input vars
X_short = BitVec('X', type_bits)
dirt = BitVec('dirt', n_bits - type_bits)
X = BVSignedUpCast(X_short, n_bits)
X_dirty = Concat(dirt, X_short)
X_cleaned = BVSignedCleanupFunction(X_dirty, type_bits)
rule.check(X, X_cleaned)
test/formal/unsigned_integer_cleanup_function.py
+40
View File
@@ -0,0 +1,40 @@
from opcodes import AND
from rule import Rule
from util import BVUnsignedCleanupFunction, BVUnsignedUpCast
from z3 import BitVec, BitVecVal, Concat
"""
Overflow checked unsigned integer multiplication.
"""
n_bits = 256
# Check that YulUtilFunction::cleanupFunction cleanup matches BVUnsignedCleanupFunction
for type_bits in range(8,256,8):
rule = Rule()
# Input vars
X = BitVec('X', n_bits)
mask = BitVecVal((1 << type_bits) - 1, n_bits)
cleaned_reference = BVUnsignedCleanupFunction(X, type_bits)
cleaned = AND(X, mask)
rule.check(cleaned, cleaned_reference)
# Check that BVUnsignedCleanupFunction properly cleans up values.
for type_bits in range(8,256,8):
rule = Rule()
# Input vars
X_short = BitVec('X', type_bits)
dirt = BitVec('dirt', n_bits - type_bits)
X = BVUnsignedUpCast(X_short, n_bits)
X_dirty = Concat(dirt, X_short)
X_cleaned = BVUnsignedCleanupFunction(X_dirty, type_bits)
rule.check(X, X_cleaned)
test/formal/util.py
+15
View File
@@ -25,3 +25,18 @@ def BVSignedMax(type_bits, n_bits):
def BVSignedMin(type_bits, n_bits):
assert type_bits <= n_bits
return BitVecVal(-(1 << (type_bits - 1)), n_bits)
def BVSignedCleanupFunction(x, type_bits):
assert x.size() >= type_bits
sign_mask = BitVecVal(1, x.size()) << (type_bits - 1)
bit_mask = (BitVecVal(1, x.size()) << type_bits) - 1
return If(
x & sign_mask == 0,
x & bit_mask,
x | ~bit_mask
)
def BVUnsignedCleanupFunction(x, type_bits):
assert x.size() >= type_bits
bit_mask = (BitVecVal(1, x.size()) << type_bits) - 1
return x & bit_mask