cerc-io/solidity
11
0
Fork 0
mirror of https://github.com/ethereum/solidity synced 2023-10-03 13:03:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Report out of bounds index access

Browse Source
This commit is contained in:
Leonardo Alt
2021-03-30 10:28:48 +02:00
parent 2346ec1c0c
commit dbd067d6db
208 changed files with 1619 additions and 608 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/libsolidity/smtCheckerTests/array_members/length_1d_assignment_2d_memory_to_memory.sol
+1
View File
@@ -3,6 +3,7 @@ pragma abicoder v2;
contract C {
function f(uint[][] memory arr) public pure {
require(arr.length > 0);
uint[][] memory arr2 = arr;
assert(arr2[0].length == arr[0].length);
assert(arr.length == arr2.length);
test/libsolidity/smtCheckerTests/array_members/length_1d_assignment_2d_storage_to_storage.sol
+6
View File
@@ -4,6 +4,12 @@ pragma abicoder v2;
contract C {
uint[][] arr;
uint[][] arr2;
constructor() {
arr.push();
arr.push();
arr2.push();
arr2.push();
}
function f() public view {
assert(arr2[0].length == arr[0].length);
assert(arr2.length == arr.length);
test/libsolidity/smtCheckerTests/array_members/length_1d_copy_2d_memory_to_storage.sol
+1
View File
@@ -4,6 +4,7 @@ pragma abicoder v2;
contract C {
uint[][] arr;
function f(uint[][] memory arr2) public {
require(arr2.length > 0);
arr = arr2;
assert(arr2[0].length == arr[0].length);
assert(arr2.length == arr.length);
test/libsolidity/smtCheckerTests/array_members/length_1d_copy_2d_storage_to_memory.sol
+6
View File
@@ -3,6 +3,12 @@ pragma abicoder v2;
contract C {
uint[][] arr;
constructor() {
arr.push();
arr.push();
arr.push();
arr.push();
}
function f() public view {
uint[][] memory arr2 = arr;
assert(arr2[0].length == arr[0].length);
test/libsolidity/smtCheckerTests/array_members/length_1d_mapping_array_2d_1.sol
+2 -1
View File
@@ -2,8 +2,9 @@ pragma experimental SMTChecker;
contract C {
mapping (uint => uint[][]) map;
function f(uint x, uint y) public view {
function f(uint x, uint y) public {
require(x == y);
map[x].push();
assert(map[x][0].length == map[y][0].length);
}
}
test/libsolidity/smtCheckerTests/array_members/length_1d_struct_array_2d_1.sol
+10 -1
View File
@@ -6,8 +6,17 @@ contract C {
}
S s1;
S s2;
constructor() {
s1.arr.push();
s2.arr.push();
s1.arr[0].push();
s1.arr[0].push();
s1.arr[0].push();
s2.arr[0].push();
s2.arr[0].push();
s2.arr[0].push();
}
function f() public view {
assert(s1.arr[0].length == s2.arr[0].length);
}
}
// ----
test/libsolidity/smtCheckerTests/array_members/length_same_after_assignment.sol
+6
View File
@@ -2,6 +2,12 @@ pragma experimental SMTChecker;
contract C {
uint[] arr;
constructor() {
arr.push();
arr.push();
arr.push();
arr.push();
}
function f() public view {
uint[] memory arr2 = arr;
arr2[2] = 3;
test/libsolidity/smtCheckerTests/array_members/length_same_after_assignment_2.sol
+11 -2
View File
@@ -2,12 +2,21 @@ pragma experimental SMTChecker;
contract C {
uint[][] arr;
uint[][] arr2;
constructor() {
arr.push();
arr.push();
arr.push();
arr.push();
arr[2].push();
arr[2].push();
arr[2].push();
arr[2].push();
}
function f() public {
uint x = arr[2].length;
uint y = arr[3].length;
uint z = arr.length;
arr[2][333] = 444;
arr[2][3] = 444;
assert(arr[2].length == x);
assert(arr[3].length == y);
assert(arr.length == z);
test/libsolidity/smtCheckerTests/array_members/length_same_after_assignment_2_fail.sol
+16 -5
View File
@@ -2,18 +2,29 @@ pragma experimental SMTChecker;
contract C {
uint[][] arr;
uint[][] arr2;
constructor() {
arr.push();
arr.push();
arr.push();
arr.push();
arr[2].push();
arr[2].push();
arr[2].push();
arr[2].push();
}
function f() public {
uint x = arr[2].length;
uint y = arr[3].length;
uint z = arr.length;
arr[2][333] = 444;
arr[2][3] = 444;
assert(arr[2].length != x);
assert(arr[3].length != y);
assert(arr.length != z);
}
}
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (198-224): CHC: Assertion violation happens here.\nCounterexample:\narr = [], arr2 = []\n\nTransaction trace:\nC.constructor()\nState: arr = [], arr2 = []\nC.f()
// Warning 6328: (228-254): CHC: Assertion violation happens here.\nCounterexample:\narr = [], arr2 = []\n\nTransaction trace:\nC.constructor()\nState: arr = [], arr2 = []\nC.f()
// Warning 6328: (258-281): CHC: Assertion violation happens here.\nCounterexample:\narr = [], arr2 = []\n\nTransaction trace:\nC.constructor()\nState: arr = [], arr2 = []\nC.f()
// Warning 6328: (324-350): CHC: Assertion violation happens here.
// Warning 6328: (354-380): CHC: Assertion violation happens here.
// Warning 6328: (384-407): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/array_members/length_same_after_assignment_3.sol
+13 -1
View File
@@ -2,7 +2,19 @@ pragma experimental SMTChecker;
contract C {
uint[][] arr;
uint[][] arr2;
constructor() {
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
}
function f() public {
uint x = arr[2].length;
uint y = arr[3].length;
test/libsolidity/smtCheckerTests/array_members/length_same_after_assignment_3_fail.sol
+15 -5
View File
@@ -2,7 +2,17 @@ pragma experimental SMTChecker;
contract C {
uint[][] arr;
uint[][] arr2;
constructor() {
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
}
function f() public {
uint x = arr[2].length;
uint y = arr[3].length;
@@ -16,7 +26,7 @@ contract C {
}
}
// ----
// Warning 6328: (222-248): CHC: Assertion violation happens here.\nCounterexample:\narr = [], arr2 = []\n\nTransaction trace:\nC.constructor()\nState: arr = [], arr2 = []\nC.f()
// Warning 6328: (252-278): CHC: Assertion violation happens here.\nCounterexample:\narr = [], arr2 = []\n\nTransaction trace:\nC.constructor()\nState: arr = [], arr2 = []\nC.f()
// Warning 6328: (282-305): CHC: Assertion violation happens here.\nCounterexample:\narr = [], arr2 = []\n\nTransaction trace:\nC.constructor()\nState: arr = [], arr2 = []\nC.f()
// Warning 6328: (309-335): CHC: Assertion violation happens here.\nCounterexample:\narr = [], arr2 = []\n\nTransaction trace:\nC.constructor()\nState: arr = [], arr2 = []\nC.f()
// Warning 6328: (352-378): CHC: Assertion violation happens here.\nCounterexample:\narr = [[], [], [], [], [], [], [], [], []]\n\nTransaction trace:\nC.constructor()\nState: arr = [[], [], [], [], [], [], [], [], []]\nC.f()
// Warning 6328: (382-408): CHC: Assertion violation happens here.\nCounterexample:\narr = [[], [], [], [], [], [], [], [], []]\n\nTransaction trace:\nC.constructor()\nState: arr = [[], [], [], [], [], [], [], [], []]\nC.f()
// Warning 6328: (412-435): CHC: Assertion violation happens here.\nCounterexample:\narr = [[], [], [], [], [], [], [], [], []]\n\nTransaction trace:\nC.constructor()\nState: arr = [[], [], [], [], [], [], [], [], []]\nC.f()
// Warning 6328: (439-465): CHC: Assertion violation happens here.\nCounterexample:\narr = [[], [], [], [], [], [], [], [], []]\n\nTransaction trace:\nC.constructor()\nState: arr = [[], [], [], [], [], [], [], [], []]\nC.f()
test/libsolidity/smtCheckerTests/array_members/pop_2d_unsafe.sol
+2 -1
View File
@@ -3,10 +3,11 @@ pragma experimental SMTChecker;
contract C {
uint[][] a;
function f() public {
a.push();
a.push();
a[0].push();
a[1].pop();
}
}
// ----
// Warning 2529: (111-121): CHC: Empty array "pop" happens here.\nCounterexample:\na = [[0]]\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
// Warning 2529: (123-133): CHC: Empty array "pop" happens here.\nCounterexample:\na = [[0], []]\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
test/libsolidity/smtCheckerTests/array_members/push_as_lhs_2d_2.sol
+1 -1
View File
@@ -4,6 +4,6 @@ contract C {
function s() public returns (int[] memory) {
array2d.push() = array2d.push();
assert(array2d[array2d.length - 1].length == array2d[array2d.length - 2].length);
return array2d[2];
return array2d[1];
}
}
test/libsolidity/smtCheckerTests/array_members/push_as_lhs_and_rhs_2d_1.sol
+1 -1
View File
@@ -16,4 +16,4 @@ contract C {
}
}
// ----
// Warning 6328: (317-343): CHC: Assertion violation happens here.\nCounterexample:\nb = [[0], [0]]\n\nTransaction trace:\nC.constructor()\nState: b = []\nC.f()
// Warning 6328: (317-343): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/array_members/push_storage_ref_safe_aliasing.sol
+2
View File
@@ -14,5 +14,7 @@ contract C {
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6368: (212-216): CHC: Out of bounds access happens here.
// Warning 6368: (217-221): CHC: Out of bounds access happens here.
// Warning 3944: (217-232): CHC: Underflow (resulting value less than 0) happens here.
// Warning 6328: (205-239): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/array_members/push_storage_ref_unsafe_aliasing.sol
+4 -1
View File
@@ -8,8 +8,11 @@ contract C {
a[0][0] = 16;
uint[] storage b = a[0];
b[0] = 32;
// Access is safe but fails due to aliasing.
assert(a[0][0] == 16);
}
}
// ----
// Warning 6328: (167-188): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
// Warning 6368: (221-225): CHC: Out of bounds access happens here.\nCounterexample:\na = []\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
// Warning 6368: (221-228): CHC: Out of bounds access happens here.\nCounterexample:\na = [[], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15]]\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
// Warning 6328: (214-235): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
test/libsolidity/smtCheckerTests/array_members/push_storage_ref_unsafe_length.sol
+19 -4
View File
@@ -4,20 +4,35 @@ contract C {
uint[][] a;
uint[][][] c;
uint[] d;
constructor() {
c.push().push().push();
d.push(); d.push();
}
function f() public {
a.push();
uint[] storage b = a[0];
// Access is safe but oob reported due to aliasing.
c[0][0][0] = 12;
d[5] = 7;
// Access is safe but oob reported due to aliasing.
d[1] = 7;
b.push(8);
assert(a[0].length == 0);
// Safe but knowledge about `c` is erased because `b` could be pointing to `c[x][y]`.
// Access is safe but oob reported due to aliasing.
assert(c[0][0][0] == 12);
// Safe but knowledge about `d` is erased because `b` could be pointing to `d`.
// Removed assertion because current Spacer seg faults in cex generation.
//assert(d[5] == 7);
//assert(d[1] == 7);
}
}
// ----
// Warning 6328: (193-217): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nState: a = [], c = [], d = []\nC.f()
// Warning 6328: (309-333): CHC: Assertion violation happens here.
// Warning 6368: (271-275): CHC: Out of bounds access happens here.
// Warning 6368: (271-278): CHC: Out of bounds access might happen here.
// Warning 6368: (271-281): CHC: Out of bounds access might happen here.
// Warning 6368: (344-348): CHC: Out of bounds access happens here.
// Warning 6368: (376-380): CHC: Out of bounds access happens here.\nCounterexample:\na = [], d = [5, 5, 5, 5, 5, 5, 5, 5, 7, 5, 9, 5, 11, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5]\n\nTransaction trace:\nC.constructor()\nState: a = [], c = [[[0]]], d = [0, 0]\nC.f()
// Warning 6328: (369-393): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nState: a = [], c = [[[0]]], d = [0, 0]\nC.f()
// Warning 6368: (546-550): CHC: Out of bounds access happens here.\nCounterexample:\nc = []\n\nTransaction trace:\nC.constructor()\nState: a = [], c = [[[0]]], d = [0, 0]\nC.f()
// Warning 6368: (546-553): CHC: Out of bounds access happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nState: a = [], c = [[[0]]], d = [0, 0]\nC.f()
// Warning 6368: (546-556): CHC: Out of bounds access happens here.
// Warning 6328: (539-563): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/array_members/push_zero_2d_safe.sol
+1 -1
View File
@@ -4,7 +4,7 @@ contract C {
uint[][] a;
function f() public {
a.push();
a[0].push();
a[a.length - 1].push();
assert(a[a.length - 1][0] == 0);
}
}
test/libsolidity/smtCheckerTests/array_members/push_zero_2d_unsafe.sol
+2 -2
View File
@@ -4,9 +4,9 @@ contract C {
uint[][] a;
function f() public {
a.push();
a[0].push();
a[a.length - 1].push();
assert(a[a.length - 1][0] == 100);
}
}
// ----
// Warning 6328: (111-144): CHC: Assertion violation happens here.\nCounterexample:\na = [[0]]\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
// Warning 6328: (122-155): CHC: Assertion violation happens here.\nCounterexample:\na = [[0]]\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()