fix: Memory edge case in pad
& padMemory
#2
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
Fixes an edge case in
LibKeccak
'spad
/padMemory
functions, where it was possible for dirty bits to enter the zero'd out padding space. This is due to a detail of solidity's memory safety considerations, where it may leave certain data after the free memory pointer dirty at times so that the memory can be reused without expanding further, for example when it abi encodes the calldata for an external call (contract.method(params)
syntax):How it's fixed
We now manually clean the memory inbetween the padding bytes that we store, just like solc would.
Testing
expectSafeMemory
tests for the padding functions. These assert that no memory is writtten to out of bounds of the expected range.brutalizeMemory
helper. This directly reproduces the bug found while fuzzing in the monorepo on the older version, and asserts that the full flow is safe when allocating in non-clean memory.