Merge pull request #2618 from CortexFoundation/dev

core/vm: avoid escape to heap

Author: ucwong

core/vm/contracts.go

@@ -271,11 +271,13 @@ func (c *ecrecover) Run(input []byte) ([]byte, error) {
 	if bitutil.TestBytes(input[32:63]) || !crypto.ValidateSignatureValues(v, r, s, false) {
 		return nil, nil
 	}
-	sig := make([]byte, 65)
-	copy(sig, input[64:128])
+	// We must make sure not to modify the 'input', so placing the 'v' along with
+	// the signature needs to be done on a new allocation
+	var sig [65]byte
+	copy(sig[:], input[64:128])
 	sig[64] = v
 	// v needs to be at the end for libsecp256k1
-	pubKey, err := crypto.Ecrecover(input[:32], sig)
+	pubKey, err := crypto.Ecrecover(input[:32], sig[:])
 	// make sure the public key is a valid one
 	if err != nil {
 		return nil, nil