cerc-io/solidity
11
0
Fork 0
mirror of https://github.com/ethereum/solidity synced 2023-10-03 13:03:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #13026 from ethereum/develop

Browse Source 
Merge develop into breaking.
This commit is contained in:
chriseth
2022-05-16 15:29:39 +02:00
committed by GitHub
parent a137d42094 a3bd01d9fc
commit 3c2cee5836
43 changed files with 292 additions and 133 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/bugs.json
+10
View File
@@ -1,4 +1,14 @@
[
{
"uid": "SOL-2022-2",
"name": "NestedCallataArrayAbiReencodingSizeValidation",
"summary": "ABI-reencoding of nested dynamic calldata arrays did not always perform proper size checks against the size of calldata and could read beyond ``calldatasize()``.",
"description": "Calldata validation for nested dynamic types is deferred until the first access to the nested values. Such an access may for example be a copy to memory or an index or member access to the outer type. While in most such accesses calldata validation correctly checks that the data area of the nested array is completely contained in the passed calldata (i.e. in the range [0, calldatasize()]), this check may not be performed, when ABI encoding such nested types again directly from calldata. For instance, this can happen, if a value in calldata with a nested dynamic array is passed to an external call, used in ``abi.encode`` or emitted as event. In such cases, if the data area of the nested array extends beyond ``calldatasize()``, ABI encoding it did not revert, but continued reading values from beyond ``calldatasize()`` (i.e. zero values).",
"link": "https://blog.soliditylang.org/2022/05/17/calldata-reencode-size-check-bug/",
"introduced": "0.5.8",
"fixed": "0.8.14",
"severity": "very low"
},
{
"uid": "SOL-2022-1",
"name": "AbiEncodeCallLiteralAsFixedBytesBug",
docs/bugs_by_version.json
+50 -3
View File
@@ -1036,6 +1036,7 @@
},
"0.5.10": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
"EmptyByteArrayCopy",
@@ -1051,6 +1052,7 @@
},
"0.5.11": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
"EmptyByteArrayCopy",
@@ -1065,6 +1067,7 @@
},
"0.5.12": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
"EmptyByteArrayCopy",
@@ -1079,6 +1082,7 @@
},
"0.5.13": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
"EmptyByteArrayCopy",
@@ -1093,6 +1097,7 @@
},
"0.5.14": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
"EmptyByteArrayCopy",
@@ -1109,6 +1114,7 @@
},
"0.5.15": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
"EmptyByteArrayCopy",
@@ -1124,6 +1130,7 @@
},
"0.5.16": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
"EmptyByteArrayCopy",
@@ -1138,6 +1145,7 @@
},
"0.5.17": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
"EmptyByteArrayCopy",
@@ -1269,6 +1277,7 @@
},
"0.5.8": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
"EmptyByteArrayCopy",
@@ -1287,6 +1296,7 @@
},
"0.5.9": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
"EmptyByteArrayCopy",
@@ -1304,6 +1314,7 @@
},
"0.6.0": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
"EmptyByteArrayCopy",
@@ -1319,6 +1330,7 @@
},
"0.6.1": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
"EmptyByteArrayCopy",
@@ -1333,6 +1345,7 @@
},
"0.6.10": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
@@ -1343,6 +1356,7 @@
},
"0.6.11": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
@@ -1353,6 +1367,7 @@
},
"0.6.12": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
@@ -1363,6 +1378,7 @@
},
"0.6.2": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
"EmptyByteArrayCopy",
@@ -1377,6 +1393,7 @@
},
"0.6.3": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
"EmptyByteArrayCopy",
@@ -1391,6 +1408,7 @@
},
"0.6.4": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
"EmptyByteArrayCopy",
@@ -1405,6 +1423,7 @@
},
"0.6.5": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
@@ -1419,6 +1438,7 @@
},
"0.6.6": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
@@ -1432,6 +1452,7 @@
},
"0.6.7": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
@@ -1445,6 +1466,7 @@
},
"0.6.8": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
@@ -1455,6 +1477,7 @@
},
"0.6.9": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
@@ -1466,6 +1489,7 @@
},
"0.7.0": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
@@ -1476,6 +1500,7 @@
},
"0.7.1": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
@@ -1487,6 +1512,7 @@
},
"0.7.2": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
@@ -1497,6 +1523,7 @@
},
"0.7.3": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching",
@@ -1506,6 +1533,7 @@
},
"0.7.4": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching"
@@ -1514,6 +1542,7 @@
},
"0.7.5": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching"
@@ -1522,6 +1551,7 @@
},
"0.7.6": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching"
@@ -1530,6 +1560,7 @@
},
"0.8.0": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching"
@@ -1538,6 +1569,7 @@
},
"0.8.1": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching"
@@ -1545,27 +1577,34 @@
"released": "2021-01-27"
},
"0.8.10": {
"bugs": [],
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation"
],
"released": "2021-11-09"
},
"0.8.11": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"AbiEncodeCallLiteralAsFixedBytesBug"
],
"released": "2021-12-20"
},
"0.8.12": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"AbiEncodeCallLiteralAsFixedBytesBug"
],
"released": "2022-02-16"
},
"0.8.13": {
"bugs": [],
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation"
],
"released": "2022-03-16"
},
"0.8.2": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory",
"KeccakCaching"
@@ -1574,6 +1613,7 @@
},
"0.8.3": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables",
"ABIDecodeTwoDimensionalArrayMemory"
],
@@ -1581,37 +1621,44 @@
},
"0.8.4": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables"
],
"released": "2021-04-21"
},
"0.8.5": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables"
],
"released": "2021-06-10"
},
"0.8.6": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables"
],
"released": "2021-06-22"
},
"0.8.7": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"SignedImmutables"
],
"released": "2021-08-11"
},
"0.8.8": {
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation",
"UserDefinedValueTypesBug",
"SignedImmutables"
],
"released": "2021-09-27"
},
"0.8.9": {
"bugs": [],
"bugs": [
"NestedCallataArrayAbiReencodingSizeValidation"
],
"released": "2021-09-29"
}
}
docs/smtchecker.rst
+5
View File
@@ -629,6 +629,11 @@ option ``--model-checker-solvers {all,cvc4,smtlib2,z3}`` or the JSON option
- if a dynamic ``z3`` library of version 4.8.x is installed in a Linux system (from Solidity 0.7.6);
- statically in ``soljson.js`` (from Solidity 0.6.9), that is, the Javascript binary of the compiler.
.. note::
z3 version 4.8.16 broke ABI compatibility with previous versions and cannot
be used with solc <=0.8.13. If you are using z3 >=4.8.16 please use solc
>=0.8.14.
Since both BMC and CHC use ``z3``, and ``z3`` is available in a greater variety
of environments, including in the browser, most users will almost never need to be
concerned about this option. More advanced users might apply this option to try
docs/types/reference-types.rst
+1 -1
View File
@@ -349,7 +349,7 @@ Array Members
**pop()**:
Dynamic storage arrays and ``bytes`` (not ``string``) have a member
function called ``pop()`` that you can use to remove an element from the
end of the array. This also implicitly calls :ref:`delete<delete>` on the removed element.
end of the array. This also implicitly calls :ref:`delete<delete>` on the removed element. The function returns nothing.
.. note::
Increasing the length of a storage array by calling ``push()``