Skip to content

Commit

Permalink
baseline: Fix incorrect exit after invalid jump
Browse files Browse the repository at this point in the history
To handle invalid jump the implementation targets the byte just after
the official code length. For padded code this byte may be uninitialized
push data causing unpredictable behavior. The fix is to also init this
byte to OP_STOP.
  • Loading branch information
chfast committed Aug 3, 2021
1 parent d67c09a commit 082d1d7
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 1 deletion.
9 changes: 9 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,14 @@ The format is based on [Keep a Changelog],
and this project adheres to [Semantic Versioning].


## [0.8.1] — unreleased

### Fixed

- baseline: Fix incorrect exit after invalid jump.
[#370](https://github.com/ethereum/evmone/pull/370)


## [0.8.0] — 2021-07-01

## Added
Expand Down Expand Up @@ -265,6 +273,7 @@ It delivers fully-compatible and high-speed EVM implementation.
- The [intx 0.2.0](https://github.com/chfast/intx/releases/tag/v0.2.0) library is used for 256-bit precision arithmetic.


[0.8.1]: https://github.com/ethereum/evmone/compare/v0.8.0..release/v0.8.0
[0.8.0]: https://github.com/ethereum/evmone/releases/tag/v0.8.0
[0.7.0]: https://github.com/ethereum/evmone/releases/tag/v0.7.0
[0.6.0]: https://github.com/ethereum/evmone/releases/tag/v0.6.0
Expand Down
3 changes: 2 additions & 1 deletion lib/evmone/baseline.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,8 @@ CodeAnalysis analyze(const uint8_t* code, size_t code_size)
// Using "raw" new operator instead of std::make_unique() to get uninitialized array.
std::unique_ptr<uint8_t[]> padded_code{new uint8_t[i + 1]}; // +1 for the final STOP.
std::copy_n(code, code_size, padded_code.get());
padded_code[i] = OP_STOP; // Set final STOP at the code end.
padded_code[code_size] = OP_STOP; // Used to terminate invalid jumps, see op_jump().
padded_code[i] = OP_STOP; // Set final STOP at the code end - guarantees loop termination.

// TODO: Using fixed-size padding of 33, the padded code buffer and jumpdest bitmap can be
// created with single allocation.
Expand Down

0 comments on commit 082d1d7

Please sign in to comment.