Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view

This file was deleted.

This file was deleted.

This file was deleted.

This file was deleted.

This file was deleted.

10 changes: 0 additions & 10 deletions test/libsolidity/semanticTests/abiEncoderV2/dynamic_arrays.sol

This file was deleted.

This file was deleted.

Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
pragma abicoder v2;
contract Test {
struct MemoryUint {
uint field;
}
function test() public pure returns (uint) {
uint[] memory before = new uint[](1); // at offset 0x80
// Two problems here: The first offset is zero, the second offset is missing.
bytes memory corrupt = abi.encode(
uint(32), // offset to "tuple"
uint(0) // bogus first element
);

// At this point the free pointer is 0x80 + 64 (size of before) + 32 (length field of corrupt) + 64 (two encoded words)
//
// Now let's put random junk into memory immediately after the bogus first element. Our goal is to overflow the read pointer to point to before.
// The value read out at this point will be added to beginning of the encoded tuple, AKA corrupt + 64. We need then to write x where:
// x + 0x80 + 64 (before) + 32 (length of corrupt) + 32 (first word of corrupt) = 0x80 (mod 2^256)
// that is MAX_UINT - 128
MemoryUint memory afterCorrupt;
afterCorrupt.field = uint(0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff80);
before[0] = 123456;
uint[][2] memory decoded = abi.decode(corrupt, (uint[][2]));
return decoded[1][0];
}
}
// ====
// revertStrings: debug
// ----
// test() -> FAILURE, hex"08c379a0", 0x20, 43, "ABI decoding: invalid calldata a", "rray stride"
Original file line number Diff line number Diff line change
Expand Up @@ -6,23 +6,25 @@ contract Test {
}
function withinArray() public pure returns (uint) {
uint[] memory before = new uint[](1);
bytes memory corrupt = abi.encode(uint(32),
uint(2));
bytes memory corrupt = abi.encode(
uint(32),
uint(2)
);
MemoryTuple memory afterCorrupt;
before[0] = 123456;
/*
As above, but in this case we are adding to:
0x80 + 64 (before) + 32 (length of corrupt) + 32 (offset) + 32 (field pointer)
giving MAX_UINT - 96
*/

// As above, but in this case we are adding to:
// 0x80 + 64 (before) + 32 (length of corrupt) + 32 (offset) + 32 (field pointer)
// giving MAX_UINT - 96
afterCorrupt.field1 = uint(0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff60);
afterCorrupt.field2 = uint(0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff60);
uint[][] memory decoded = abi.decode(corrupt, (uint[][]));
/*
Will return 123456 * 2, AKA before has been copied twice
*/

//Will return 123456 * 2, AKA before has been copied twice
return decoded[0][0] + decoded[1][0];
}
}
// ====
// revertStrings: debug
// ----
// withinArray() -> FAILURE
// withinArray() -> FAILURE, hex"08c379a0", 0x20, 43, "ABI decoding: invalid calldata a", "rray stride"
Original file line number Diff line number Diff line change
Expand Up @@ -6,16 +6,18 @@ contract Test {
function test() public pure returns (uint) {
uint[] memory before = new uint[](1); // at offset 0x80
bytes memory corrupt = abi.encode(
uint(32),
uint(0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff80),
uint(0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff80)
);
uint(32),
uint(0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff80),
uint(0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff80)
);
MemoryUint memory afterCorrupt;
afterCorrupt.field = uint(0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff80);
before[0] = 123456;
uint[][2] memory decoded = abi.decode(corrupt, (uint[][2]));
return decoded[1][0];
}
}
// ====
// revertStrings: debug
// ----
// test() -> FAILURE
// test() -> FAILURE, hex"08c379a0", 0x20, 43, "ABI decoding: invalid calldata a", "rray offset"
Original file line number Diff line number Diff line change
@@ -1,7 +1,5 @@
// Tests that this will not end up using a "bytes0" type
// (which would assert)
pragma abicoder v2;


contract C {
function f() public pure returns (bytes memory, bytes memory) {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -63,10 +63,6 @@ contract C {
}
}

// via yul disabled because of stack issues.

// ====
// compileViaYul: false
// ----
// f1(bytes[1]): 0x20, 0x20, 0x3, hex"0102030000000000000000000000000000000000000000000000000000000000" -> 0x3, 0x1, 0x2, 0x3
// f2(bytes[1],bytes[1]): 0x40, 0xa0, 0x20, 0x3, hex"0102030000000000000000000000000000000000000000000000000000000000", 0x20, 0x2, hex"0102000000000000000000000000000000000000000000000000000000000000" -> 0x3, 0x1, 0x2, 0x3, 0x2, 0x1, 0x2
Expand Down
Comment thread
cameel marked this conversation as resolved.
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,3 @@ contract C {
// f(uint256[]): 0x20, 0 ->
// f(uint256[]): 0x20, 1 -> FAILURE
// f(uint256[]): 0x20, 2 -> FAILURE

Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
pragma abicoder v1;

contract C {
function f(uint[] calldata) public {}
}
// ====
// ABIEncoderV1Only: true
// compileViaYul: false
// revertStrings: debug
// ----
// f(uint256[]): 0x20, 0 ->
// f(uint256[]): 0x20, 1 -> FAILURE, hex"08c379a0", 0x20, 43, "ABI calldata decoding: invalid d", "ata pointer"
// f(uint256[]): 0x20, 2 -> FAILURE, hex"08c379a0", 0x20, 43, "ABI calldata decoding: invalid d", "ata pointer"
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
pragma abicoder v1;

contract C {
function f(uint a, uint[] calldata b, uint c) external pure returns (uint) {
return 7;
}
}
// ====
// ABIEncoderV1Only: true
// compileViaYul: false
// revertStrings: debug
// ----
// f(uint256,uint256[],uint256): 6, 0x60, 9, 0x8000000000000000000000000000000000000000000000000000000000000002, 1, 2 -> FAILURE, hex"08c379a0", 0x20, 43, "ABI calldata decoding: invalid d", "ata pointer"
Original file line number Diff line number Diff line change
@@ -1,7 +1,11 @@
pragma abicoder v2;

contract C {
function f(uint a, uint[] calldata b, uint c) external pure returns (uint) {
return 7;
}
}
// ====
// revertStrings: debug
Comment thread
cameel marked this conversation as resolved.
// ----
// f(uint256,uint256[],uint256): 6, 0x60, 9, 0x8000000000000000000000000000000000000000000000000000000000000002, 1, 2 -> FAILURE
// f(uint256,uint256[],uint256): 6, 0x60, 9, 0x8000000000000000000000000000000000000000000000000000000000000002, 1, 2 -> FAILURE, hex"08c379a0", 0x20, 43, "ABI decoding: invalid calldata a", "rray length"
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
pragma abicoder v2;

pragma abicoder v2;

contract C {
function f(uint256[][1][] calldata a) external returns (uint256) {
Expand All @@ -16,14 +15,16 @@ contract C {
return 42;
}
}
// ====
// revertStrings: debug
// ----
// f(uint256[][1][]): 0x20, 0x0 -> 42 # valid access stub #
// f(uint256[][1][]): 0x20, 0x1 -> FAILURE # invalid on argument decoding #
// f(uint256[][1][]): 0x20, 0x1 -> FAILURE, hex"08c379a0", 0x20, 43, "ABI decoding: invalid calldata a", "rray stride" # invalid on argument decoding #
// f(uint256[][1][]): 0x20, 0x1, 0x20 -> 42 # invalid on outer access #
// g(uint256[][1][]): 0x20, 0x1, 0x20 -> FAILURE
// g(uint256[][1][]): 0x20, 0x1, 0x20 -> FAILURE, hex"08c379a0", 0x20, 0x1c, "Invalid calldata tail offset"
// f(uint256[][1][]): 0x20, 0x1, 0x20, 0x20 -> 42 # invalid on inner access #
// g(uint256[][1][]): 0x20, 0x1, 0x20, 0x20 -> 42
// h(uint256[][1][]): 0x20, 0x1, 0x20, 0x20 -> FAILURE
// h(uint256[][1][]): 0x20, 0x1, 0x20, 0x20 -> FAILURE, hex"08c379a0", 0x20, 0x1c, "Invalid calldata tail offset"
// f(uint256[][1][]): 0x20, 0x1, 0x20, 0x20, 0x1 -> 42
// g(uint256[][1][]): 0x20, 0x1, 0x20, 0x20, 0x1 -> 42
// h(uint256[][1][]): 0x20, 0x1, 0x20, 0x20, 0x1 -> FAILURE
// h(uint256[][1][]): 0x20, 0x1, 0x20, 0x20, 0x1 -> FAILURE, hex"08c379a0", 0x20, 0x17, "Calldata tail too short"
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
pragma abicoder v2;

pragma abicoder v2;

contract C {
function f(uint256[][] calldata a) external returns (uint256) {
Expand All @@ -11,10 +10,12 @@ contract C {
return 42;
}
}
// ====
// revertStrings: debug
// ----
// f(uint256[][]): 0x20, 0x0 -> 42 # valid access stub #
// f(uint256[][]): 0x20, 0x1 -> FAILURE # invalid on argument decoding #
// f(uint256[][]): 0x20, 0x1 -> FAILURE, hex"08c379a0", 0x20, 43, "ABI decoding: invalid calldata a", "rray stride" # invalid on argument decoding #
// f(uint256[][]): 0x20, 0x1, 0x20 -> 42 # invalid on outer access #
// g(uint256[][]): 0x20, 0x1, 0x20 -> FAILURE
// g(uint256[][]): 0x20, 0x1, 0x20 -> FAILURE, hex"08c379a0", 0x20, 0x1c, "Invalid calldata tail offset"
// f(uint256[][]): 0x20, 0x1, 0x20, 0x2, 0x42 -> 42 # invalid on inner access #
// g(uint256[][]): 0x20, 0x1, 0x20, 0x2, 0x42 -> FAILURE
// g(uint256[][]): 0x20, 0x1, 0x20, 0x2, 0x42 -> FAILURE, hex"08c379a0", 0x20, 0x17, "Calldata tail too short"
Loading