Add stack overflow check in dupStackItem

matter-labs · Nov 13, 2024 · 7815225 · 7815225
1 parent 397092d
commit 7815225
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/system-contracts/contracts/EvmEmulator.yul b/system-contracts/contracts/EvmEmulator.yul
@@ -479,6 +479,11 @@ object "EvmEmulator" {
 
         function dupStackItem(sp, evmGas, position, oldStackHead) -> newSp, evmGasLeft, stackHead {
             evmGasLeft := chargeGas(evmGas, 3)
+
+            if iszero(lt(sp, BYTECODE_LEN_OFFSET())) {
+                panic()
+            }
+
             let tempSp := sub(sp, mul(0x20, sub(position, 1)))
 
             if lt(tempSp, STACK_OFFSET())  {
@@ -3527,6 +3532,11 @@ object "EvmEmulator" {
 
             function dupStackItem(sp, evmGas, position, oldStackHead) -> newSp, evmGasLeft, stackHead {
                 evmGasLeft := chargeGas(evmGas, 3)
+
+                if iszero(lt(sp, BYTECODE_LEN_OFFSET())) {
+                    panic()
+                }
+
                 let tempSp := sub(sp, mul(0x20, sub(position, 1)))
 
                 if lt(tempSp, STACK_OFFSET())  {

diff --git a/system-contracts/evm-emulator/EvmEmulatorFunctions.template.yul b/system-contracts/evm-emulator/EvmEmulatorFunctions.template.yul
@@ -417,6 +417,11 @@ function performSystemCallRevertable(to, dataLength) -> success {
 
 function dupStackItem(sp, evmGas, position, oldStackHead) -> newSp, evmGasLeft, stackHead {
     evmGasLeft := chargeGas(evmGas, 3)
+
+    if iszero(lt(sp, BYTECODE_LEN_OFFSET())) {
+        panic()
+    }
+
     let tempSp := sub(sp, mul(0x20, sub(position, 1)))
 
     if lt(tempSp, STACK_OFFSET())  {