Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug]: integer overflow in JumpTable.SubStr #3495

Open
nan01ab opened this issue Sep 21, 2024 · 0 comments · May be fixed by #3496
Open

[Bug]: integer overflow in JumpTable.SubStr #3495

nan01ab opened this issue Sep 21, 2024 · 0 comments · May be fixed by #3496

Comments

@nan01ab
Copy link

nan01ab commented Sep 21, 2024

Describe the bug
In JumpTable.SubStr, if count is set to a large int(for example, Int32.MaxValue), index + count may less than 0, and index + count > x.Length will be false, so new Buffer may allocate a large buffer(max is 2GiB)

        public virtual void SubStr(ExecutionEngine engine, Instruction instruction)
        {
            int count = (int)engine.Pop().GetInteger();
            if (count < 0)
                throw new InvalidOperationException($"The value {count} is out of range.");
            int index = (int)engine.Pop().GetInteger();
            if (index < 0)
                throw new InvalidOperationException($"The value {index} is out of range.");
            var x = engine.Pop().GetSpan();
            if (index + count > x.Length)
                throw new InvalidOperationException($"The value {count} is out of range.");
            Types.Buffer result = new(count, false);
            x.Slice(index, count).CopyTo(result.InnerBuffer.Span);
            engine.Push(result);
        }

To Reproduce
like this:

PUSHDATA1 0x00010203040506070809
PUSH2
PUSHINT32
0x7FFFFFFF
SUBSTR
@nan01ab nan01ab linked a pull request Sep 21, 2024 that will close this issue
14 tasks
@nan01ab nan01ab changed the title [bug]: integer overflow in JumpTable.SubStr [Bug]: integer overflow in JumpTable.SubStr Sep 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant