fix(EVM): Simplify and optimize out-of-bounds truncation in CODECOPY (

#1156)
matter-labs · Dec 19, 2024 · e7aa3a9 · e7aa3a9
1 parent fe838fc
commit e7aa3a9
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 15 deletions.
diff --git a/system-contracts/contracts/EvmEmulator.yul b/system-contracts/contracts/EvmEmulator.yul
@@ -1749,7 +1749,6 @@ object "EvmEmulator" {
                     ip := add(ip, 1)
                 }
                 case 0x39 { // OP_CODECOPY
-
                     evmGasLeft := chargeGas(evmGasLeft, 3)
 
                     let dstOffset, sourceOffset, len
@@ -1774,14 +1773,14 @@ object "EvmEmulator" {
 
                     sourceOffset := add(sourceOffset, BYTECODE_OFFSET())
 
-                    if gt(sourceOffset, MEM_LEN_OFFSET()) {
-                        sourceOffset := MEM_LEN_OFFSET()
+                    if gt(sourceOffset, bytecodeEndOffset) {
+                        sourceOffset := bytecodeEndOffset
                     }
 
                     // Check bytecode out-of-bounds access
                     let truncatedLen := len
-                    if gt(add(sourceOffset, len), MEM_LEN_OFFSET()) {
-                        truncatedLen := sub(MEM_LEN_OFFSET(), sourceOffset) // truncate
+                    if gt(add(sourceOffset, len), bytecodeEndOffset) {
+                        truncatedLen := sub(bytecodeEndOffset, sourceOffset) // truncate
                         $llvm_AlwaysInline_llvm$_memsetToZero(add(dstOffset, truncatedLen), sub(len, truncatedLen)) // pad with zeroes any out-of-bounds
                     }
 
@@ -4889,7 +4888,6 @@ object "EvmEmulator" {
                         ip := add(ip, 1)
                     }
                     case 0x39 { // OP_CODECOPY
-
                         evmGasLeft := chargeGas(evmGasLeft, 3)
 
                         let dstOffset, sourceOffset, len
@@ -4914,14 +4912,14 @@ object "EvmEmulator" {
 
                         sourceOffset := add(sourceOffset, BYTECODE_OFFSET())
 
-                        if gt(sourceOffset, MEM_LEN_OFFSET()) {
-                            sourceOffset := MEM_LEN_OFFSET()
+                        if gt(sourceOffset, bytecodeEndOffset) {
+                            sourceOffset := bytecodeEndOffset
                         }
 
                         // Check bytecode out-of-bounds access
                         let truncatedLen := len
-                        if gt(add(sourceOffset, len), MEM_LEN_OFFSET()) {
-                            truncatedLen := sub(MEM_LEN_OFFSET(), sourceOffset) // truncate
+                        if gt(add(sourceOffset, len), bytecodeEndOffset) {
+                            truncatedLen := sub(bytecodeEndOffset, sourceOffset) // truncate
                             $llvm_AlwaysInline_llvm$_memsetToZero(add(dstOffset, truncatedLen), sub(len, truncatedLen)) // pad with zeroes any out-of-bounds
                         }
 

diff --git a/system-contracts/evm-emulator/EvmEmulatorLoop.template.yul b/system-contracts/evm-emulator/EvmEmulatorLoop.template.yul
@@ -407,7 +407,6 @@ for { } true { } {
         ip := add(ip, 1)
     }
     case 0x39 { // OP_CODECOPY
-
         evmGasLeft := chargeGas(evmGasLeft, 3)
 
         let dstOffset, sourceOffset, len
@@ -432,14 +431,14 @@ for { } true { } {
 
         sourceOffset := add(sourceOffset, BYTECODE_OFFSET())
 
-        if gt(sourceOffset, MEM_LEN_OFFSET()) {
-            sourceOffset := MEM_LEN_OFFSET()
+        if gt(sourceOffset, bytecodeEndOffset) {
+            sourceOffset := bytecodeEndOffset
         }
 
         // Check bytecode out-of-bounds access
         let truncatedLen := len
-        if gt(add(sourceOffset, len), MEM_LEN_OFFSET()) {
-            truncatedLen := sub(MEM_LEN_OFFSET(), sourceOffset) // truncate
+        if gt(add(sourceOffset, len), bytecodeEndOffset) {
+            truncatedLen := sub(bytecodeEndOffset, sourceOffset) // truncate
             $llvm_AlwaysInline_llvm$_memsetToZero(add(dstOffset, truncatedLen), sub(len, truncatedLen)) // pad with zeroes any out-of-bounds
         }