mirror of
https://github.com/ethereum/solidity
synced 2023-10-03 13:03:40 +00:00
Restrict size for dynamic memory array creation.
This commit is contained in:
parent
fb7f51ffca
commit
fe9f8d520c
@ -1,5 +1,9 @@
|
|||||||
### 0.6.5 (unreleased)
|
### 0.6.5 (unreleased)
|
||||||
|
|
||||||
|
Important Bugfixes:
|
||||||
|
* Code Generator: Restrict the size of dynamic memory arrays to 64 bits during creation at runtime fixing a possible overflow.
|
||||||
|
|
||||||
|
|
||||||
Language Features:
|
Language Features:
|
||||||
|
|
||||||
|
|
||||||
|
@ -995,6 +995,12 @@ bool ExpressionCompiler::visit(FunctionCall const& _functionCall)
|
|||||||
// Fetch requested length.
|
// Fetch requested length.
|
||||||
acceptAndConvert(*arguments[0], *TypeProvider::uint256());
|
acceptAndConvert(*arguments[0], *TypeProvider::uint256());
|
||||||
|
|
||||||
|
// Make sure we can allocate memory without overflow
|
||||||
|
m_context << u256(0xffffffffffffffff);
|
||||||
|
m_context << Instruction::DUP2;
|
||||||
|
m_context << Instruction::GT;
|
||||||
|
m_context.appendConditionalRevert();
|
||||||
|
|
||||||
// Stack: requested_length
|
// Stack: requested_length
|
||||||
utils().fetchFreeMemoryPointer();
|
utils().fetchFreeMemoryPointer();
|
||||||
|
|
||||||
|
@ -0,0 +1,24 @@
|
|||||||
|
contract C {
|
||||||
|
function f() public returns (uint256) {
|
||||||
|
uint256 l = 2**256 / 32;
|
||||||
|
// This used to work without causing an error.
|
||||||
|
uint256[] memory x = new uint256[](l);
|
||||||
|
uint256[] memory y = new uint256[](1);
|
||||||
|
x[1] = 42;
|
||||||
|
// This used to overwrite the value written above.
|
||||||
|
y[0] = 23;
|
||||||
|
return x[1];
|
||||||
|
}
|
||||||
|
function g() public returns (uint256) {
|
||||||
|
uint256 l = 2**256 / 2 + 1;
|
||||||
|
// This used to work without causing an error.
|
||||||
|
uint16[] memory x = new uint16[](l);
|
||||||
|
uint16[] memory y = new uint16[](1);
|
||||||
|
x[2] = 42;
|
||||||
|
// This used to overwrite the value written above.
|
||||||
|
y[0] = 23;
|
||||||
|
return x[2];
|
||||||
|
}}
|
||||||
|
// ----
|
||||||
|
// f() -> FAILURE
|
||||||
|
// g() -> FAILURE
|
Loading…
Reference in New Issue
Block a user