Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Memory edge case in pad & padMemory #2

Merged
merged 1 commit into from
Jan 24, 2024
Merged

fix: Memory edge case in pad & padMemory #2

merged 1 commit into from
Jan 24, 2024

Conversation

clabby
Copy link
Member

@clabby clabby commented Jan 24, 2024

Overview

Fixes an edge case in LibKeccak's pad / padMemory functions, where it was possible for dirty bits to enter the zero'd out padding space. This is due to a detail of solidity's memory safety considerations, where it may leave certain data after the free memory pointer dirty at times so that the memory can be reused without expanding further, for example when it abi encodes the calldata for an external call (contract.method(params) syntax):

image

How it's fixed

We now manually clean the memory inbetween the padding bytes that we store, just like solc would.

Testing

  • expectSafeMemory tests for the padding functions. These assert that no memory is writtten to out of bounds of the expected range.
  • e2e pad -> absorption -> permutation -> squeeze process, with brutalized memory, thanks to @Vectorized's brutalizeMemory helper. This directly reproduces the bug found while fuzzing in the monorepo on the older version, and asserts that the full flow is safe when allocating in non-clean memory.

@clabby clabby merged commit 0115edb into main Jan 24, 2024
5 checks passed
@clabby clabby deleted the cl/memory-fix branch January 24, 2024 05:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant