gaspersic/solana
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix integer overflow in degenerate invoke_signed BPF syscalls (#15051)

Browse Source
This commit is contained in:
Mrmaxmeier
2021-02-03 22:32:38 +01:00
committed by GitHub
parent 02a5f7104a
commit ebbaa1f8ea
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
programs/bpf_loader/src/syscalls.rs
View File

@ -348,7 +348,7 @@ fn translate_slice_inner<'a, T>(
{ {
Err(SyscallError::UnalignedPointer.into()) Err(SyscallError::UnalignedPointer.into())
} else if len == 0 { } else if len == 0 {
Ok(unsafe { from_raw_parts_mut(0x1 as *mut T, len as usize) }) Ok(&mut [])
} else { } else {
match translate( match translate(
memory_mapping, memory_mapping,
@ -1471,7 +1471,9 @@ fn check_instruction_size(
data_len: usize, data_len: usize,
invoke_context: &Ref<&mut dyn InvokeContext>, invoke_context: &Ref<&mut dyn InvokeContext>,
) -> Result<(), EbpfError<BPFError>> { ) -> Result<(), EbpfError<BPFError>> {
let size = num_accounts * size_of::<AccountMeta>() + data_len; let size = num_accounts
.saturating_mul(size_of::<AccountMeta>())
.saturating_add(data_len);
let max_size = invoke_context let max_size = invoke_context
.get_bpf_compute_budget() .get_bpf_compute_budget()
.max_cpi_instruction_size; .max_cpi_instruction_size;