gaspersic/solana
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix integer overflow in degenerate invoke_signed BPF syscalls (#15051) (#15069)

Browse Source 
(cherry picked from commit ebbaa1f8ea)

Co-authored-by: Mrmaxmeier <Mrmaxmeier@gmail.com>
This commit is contained in:
mergify[bot]
2021-02-03 23:04:03 +00:00
committed by GitHub
parent 573304cf73
commit baf7713744
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
programs/bpf_loader/src/syscalls.rs
View File

@ -348,7 +348,7 @@ fn translate_slice_inner<'a, T>(
{
Err(SyscallError::UnalignedPointer.into())
} else if len == 0 {
Ok(unsafe { from_raw_parts_mut(0x1 as *mut T, len as usize) })
Ok(&mut [])
} else {
match translate(
memory_mapping,
@ -1471,7 +1471,9 @@ fn check_instruction_size(
data_len: usize,
invoke_context: &Ref<&mut dyn InvokeContext>,
) -> Result<(), EbpfError<BPFError>> {
let size = num_accounts * size_of::<AccountMeta>() + data_len;
let size = num_accounts
.saturating_mul(size_of::<AccountMeta>())
.saturating_add(data_len);
let max_size = invoke_context
.get_bpf_compute_budget()
.max_cpi_instruction_size;