TrueCloudLab/neoneo-go
7
0
Fork 2
Code Issues Pull requests Projects Releases Packages Wiki Activity

core: fix Neo.Contract.GetStorageContext security check

Browse source 
This syscall should only work for contracts created by current transaction and
that is what is supposed to be checked here. Do so by looking at the
differences between ic.dao and original lower DAO.
This commit is contained in:
Roman Khimov 2020-05-17 23:58:23 +03:00
parent 541d56a874
commit a43f2234dd
2 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
pkg/core/interop_system.go
View file

@ -575,8 +575,12 @@ func (ic *interopContext) contractGetStorageContext(v *vm.VM) error {
if !ok {
return fmt.Errorf("%T is not a contract state", cs)
}
contractState, err := ic.dao.GetContractState(cs.ScriptHash())
if contractState == nil || err != nil {
_, err := ic.dao.GetContractState(cs.ScriptHash())
if err != nil {
return fmt.Errorf("non-existent contract")
}
_, err = ic.lowerDao.GetContractState(cs.ScriptHash())
if err == nil {
return fmt.Errorf("contract was not created in this transaction")
}
stc := &StorageContext{

3
pkg/core/interops.go
View file

@ -27,6 +27,7 @@ type interopContext struct {
block *block.Block
tx *transaction.Transaction
dao *dao.Cached
lowerDao dao.DAO
notifications []state.NotificationEvent
log *zap.Logger
}
@ -34,7 +35,7 @@ type interopContext struct {
func newInteropContext(trigger trigger.Type, bc Blockchainer, d dao.DAO, block *block.Block, tx *transaction.Transaction, log *zap.Logger) *interopContext {
dao := dao.NewCached(d)
nes := make([]state.NotificationEvent, 0)
return &interopContext{bc, trigger, block, tx, dao, nes, log}
return &interopContext{bc, trigger, block, tx, dao, d, nes, log}
}
// SpawnVM returns a VM with script getter and interop functions set