cerc-io/solidity
11
0
Fork 0
mirror of https://github.com/ethereum/solidity synced 2023-10-03 13:03:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #838 from chriseth/ecrecover

Browse Source 
Make ecrecover return zero for malformed input.
This commit is contained in:
chriseth
2016-08-17 11:05:20 +02:00
committed by GitHub
parent a63f94e042 d731225d02
commit d5505e21eb
4 changed files with 56 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libsolidity/codegen/ExpressionCompiler.cpp
+38 -5
View File
@@ -1449,6 +1449,19 @@ void ExpressionCompiler::appendExternalFunctionCall(
argumentTypes.push_back(_arguments[i]->annotation().type);
}
if (funKind == FunctionKind::ECRecover)
{
// Clears 32 bytes of currently free memory and advances free memory pointer.
// Output area will be "start of input area" - 32.
// The reason is that a failing ECRecover cannot be detected, it will just return
// zero bytes (which we cannot detect).
solAssert(0 < retSize && retSize <= 32, "");
utils().fetchFreeMemoryPointer();
m_context << Instruction::DUP1 << u256(0) << Instruction::MSTORE;
m_context << u256(32) << Instruction::ADD;
utils().storeFreeMemoryPointer();
}
// Copy function identifier to memory.
utils().fetchFreeMemoryPointer();
if (!_functionType.isBareCall() || manualFunctionId)
@@ -1457,7 +1470,7 @@ void ExpressionCompiler::appendExternalFunctionCall(
utils().storeInMemoryDynamic(IntegerType(8 * CompilerUtils::dataStartOffset), false);
}
// If the function takes arbitrary parameters, copy dynamic length data in place.
// Move argumenst to memory, will not update the free memory pointer (but will update the memory
// Move arguments to memory, will not update the free memory pointer (but will update the memory
// pointer on the stack).
utils().encodeToMemory(
argumentTypes,
@@ -1475,12 +1488,24 @@ void ExpressionCompiler::appendExternalFunctionCall(
// function identifier [unless bare]
// contract address
// Output data will replace input data.
// Output data will replace input data, unless we have ECRecover (then, output
// area will be 32 bytes just before input area).
// put on stack: <size of output> <memory pos of output> <size of input> <memory pos of input>
m_context << u256(retSize);
utils().fetchFreeMemoryPointer();
m_context << Instruction::DUP1 << Instruction::DUP4 << Instruction::SUB;
m_context << Instruction::DUP2;
utils().fetchFreeMemoryPointer(); // This is the start of input
if (funKind == FunctionKind::ECRecover)
{
// In this case, output is 32 bytes before input and has already been cleared.
m_context << u256(32) << Instruction::DUP2 << Instruction::SUB << Instruction::SWAP1;
// Here: <input end> <output size> <outpos> <input pos>
m_context << Instruction::DUP1 << Instruction::DUP5 << Instruction::SUB;
m_context << Instruction::SWAP1;
}
else
{
m_context << Instruction::DUP1 << Instruction::DUP4 << Instruction::SUB;
m_context << Instruction::DUP2;
}
// CALL arguments: outSize, outOff, inSize, inOff (already present up to here)
// [value,] addr, gas (stack top)
@@ -1543,6 +1568,14 @@ void ExpressionCompiler::appendExternalFunctionCall(
utils().loadFromMemoryDynamic(IntegerType(160), false, true, false);
utils().convertType(IntegerType(160), FixedBytesType(20));
}
else if (funKind == FunctionKind::ECRecover)
{
// Output is 32 bytes before input / free mem pointer.
// Failing ecrecover cannot be detected, so we clear output before the call.
m_context << u256(32);
utils().fetchFreeMemoryPointer();
m_context << Instruction::SUB << Instruction::MLOAD;
}
else if (!_functionType.returnParameterTypes().empty())
{
utils().fetchFreeMemoryPointer();