[Fix]: integer overflow in JumpTable.SubStr

.gitignore

@@ -258,5 +258,10 @@ PublishProfiles
 /.vscode
 launchSettings.json
 
+# UT coverage report
+/coverages
+**/.DS_Store
+
 # Benchmarks
-**/BenchmarkDotNet.Artifacts/
+**/BenchmarkDotNet.Artifacts/
+

src/Neo.VM/JumpTable/JumpTable.Splice.cs

@@ -96,13 +96,16 @@ public virtual void SubStr(ExecutionEngine engine, Instruction instruction)
         {
             int count = (int)engine.Pop().GetInteger();
             if (count < 0)
-                throw new InvalidOperationException($"The value {count} is out of range.");
+                throw new InvalidOperationException($"The value of count {count} is out of range.");
+
             int index = (int)engine.Pop().GetInteger();
             if (index < 0)
-                throw new InvalidOperationException($"The value {index} is out of range.");
+                throw new InvalidOperationException($"The value of index {index} is out of range.");
+
             var x = engine.Pop().GetSpan();
-            if (index + count > x.Length)
-                throw new InvalidOperationException($"The value {count} is out of range.");
+            if (checked(index + count) > x.Length)
+                throw new InvalidOperationException($"The value of index {index} + count {count} is out of range.");
+
             Types.Buffer result = new(count, false);
             x.Slice(index, count).CopyTo(result.InnerBuffer.Span);
             engine.Push(result);

tests/Neo.VM.Tests/Tests/OpCodes/Splice/SUBSTR.json

@@ -473,6 +473,50 @@
           }
         }
       ]
+    },
+    {
+      "name": "Count Exceed Range Test",
+      "script": [
+        "PUSHDATA1",
+        "0x0a",
+        "0x00010203040506070809",
+        "PUSH2",
+        "PUSHINT32",
+        "0x7FFFFFFF",
+        "SUBSTR"
+      ],
+      "steps": [
+        {
+          "actions": [
+            "execute"
+          ],
+          "result": {
+            "state": "FAULT"
+          }
+        }
+      ]
+    },
+    {
+      "name": "Index Exceed Range Test",
+      "script": [
+        "PUSHDATA1",
+        "0x0a",
+        "0x00010203040506070809",
+        "PUSHINT32",
+        "0x7FFFFFFF",
+        "PUSH2",
+        "SUBSTR"
+      ],
+      "steps": [
+        {
+          "actions": [
+            "execute"
+          ],
+          "result": {
+            "state": "FAULT"
+          }
+        }
+      ]
     }
   ]
 }