fix(EVM): Add overflow checks in JUMP and JUMPI opcodes (#1159)

matter-labs · Dec 20, 2024 · 0419d3e · 0419d3e
1 parent c396c03
commit 0419d3e
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 0 deletions.
diff --git a/system-contracts/contracts/EvmEmulator.yul b/system-contracts/contracts/EvmEmulator.yul
@@ -2122,6 +2122,11 @@ object "EvmEmulator" {
                     let counter
                     counter, sp, stackHead := popStackItem(sp, stackHead)
 
+                    // Counter certainly can't be bigger than uint64.
+                    if gt(counter, MAX_UINT64()) {
+                        panic()
+                    } 
+
                     ip := add(BYTECODE_OFFSET(), counter)
 
                     // Check next opcode is JUMPDEST
@@ -2147,6 +2152,11 @@ object "EvmEmulator" {
                         continue
                     }
 
+                    // Counter certainly can't be bigger than uint64.
+                    if gt(counter, MAX_UINT64()) {
+                        panic()
+                    } 
+
                     ip := add(BYTECODE_OFFSET(), counter)
 
                     // Check next opcode is JUMPDEST
@@ -5250,6 +5260,11 @@ object "EvmEmulator" {
                         let counter
                         counter, sp, stackHead := popStackItem(sp, stackHead)
 
+                        // Counter certainly can't be bigger than uint64.
+                        if gt(counter, MAX_UINT64()) {
+                            panic()
+                        } 
+
                         ip := add(BYTECODE_OFFSET(), counter)
 
                         // Check next opcode is JUMPDEST
@@ -5275,6 +5290,11 @@ object "EvmEmulator" {
                             continue
                         }
 
+                        // Counter certainly can't be bigger than uint64.
+                        if gt(counter, MAX_UINT64()) {
+                            panic()
+                        } 
+
                         ip := add(BYTECODE_OFFSET(), counter)
 
                         // Check next opcode is JUMPDEST

diff --git a/system-contracts/evm-emulator/EvmEmulatorLoop.template.yul b/system-contracts/evm-emulator/EvmEmulatorLoop.template.yul
@@ -802,6 +802,11 @@ for { } true { } {
         let counter
         counter, sp, stackHead := popStackItem(sp, stackHead)
 
+        // Counter certainly can't be bigger than uint64.
+        if gt(counter, MAX_UINT64()) {
+            panic()
+        } 
+
         ip := add(BYTECODE_OFFSET(), counter)
 
         // Check next opcode is JUMPDEST
@@ -827,6 +832,11 @@ for { } true { } {
             continue
         }
 
+        // Counter certainly can't be bigger than uint64.
+        if gt(counter, MAX_UINT64()) {
+            panic()
+        } 
+
         ip := add(BYTECODE_OFFSET(), counter)
 
         // Check next opcode is JUMPDEST