vm: restrict max size in NEWARRAY/NEWSTRUCT

This commit is contained in:
Evgenii Stratonikov 2019-10-17 11:03:21 +03:00
parent 85f7732d44
commit 8abcaeee6f
2 changed files with 26 additions and 4 deletions

View file

@ -753,8 +753,11 @@ func (v *VM) execute(ctx *Context, op Instruction, parameter []byte) {
case *ArrayItem:
v.estack.PushVal(t)
default:
n := item.BigInt()
items := makeArrayOfFalses(int(n.Int64()))
n := item.BigInt().Int64()
if n > MaxArraySize {
panic("too long array")
}
items := makeArrayOfFalses(int(n))
v.estack.PushVal(&ArrayItem{items})
}
@ -766,8 +769,11 @@ func (v *VM) execute(ctx *Context, op Instruction, parameter []byte) {
case *StructItem:
v.estack.PushVal(t)
default:
n := item.BigInt()
items := makeArrayOfFalses(int(n.Int64()))
n := item.BigInt().Int64()
if n > MaxArraySize {
panic("too long struct")
}
items := makeArrayOfFalses(int(n))
v.estack.PushVal(&StructItem{items})
}

View file

@ -538,6 +538,14 @@ func TestNEWARRAYByteArray(t *testing.T) {
assert.Equal(t, &ArrayItem{[]StackItem{}}, vm.estack.Pop().value)
}
func TestNEWARRAYBadSize(t *testing.T) {
prog := makeProgram(NEWARRAY)
vm := load(prog)
vm.estack.PushVal(MaxArraySize + 1)
vm.Run()
assert.Equal(t, true, vm.state.HasFlag(faultState))
}
func TestNEWSTRUCTInteger(t *testing.T) {
prog := makeProgram(NEWSTRUCT)
vm := load(prog)
@ -580,6 +588,14 @@ func TestNEWSTRUCTByteArray(t *testing.T) {
assert.Equal(t, &StructItem{[]StackItem{}}, vm.estack.Pop().value)
}
func TestNEWSTRUCTBadSize(t *testing.T) {
prog := makeProgram(NEWSTRUCT)
vm := load(prog)
vm.estack.PushVal(MaxArraySize + 1)
vm.Run()
assert.Equal(t, true, vm.state.HasFlag(faultState))
}
func TestAPPENDArray(t *testing.T) {
prog := makeProgram(DUP, PUSH5, APPEND)
vm := load(prog)