Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Overflow in GAS_MCL and GAS_MCLI #192

Closed
mediremi opened this issue Aug 7, 2022 · 2 comments
Closed

Overflow in GAS_MCL and GAS_MCLI #192

mediremi opened this issue Aug 7, 2022 · 2 comments
Labels
bug Something isn't working fuel-vm Related to the `fuel-vm` crate. needs-investigation

Comments

@mediremi
Copy link
Contributor

mediremi commented Aug 7, 2022

Both GAS_MCL and GAS_MCLI fail to handle multiply with overflow.

GAS_MCL:

thread '<unnamed>' panicked at 'attempt to multiply with overflow', src/interpreter/gas/consts.rs:91:58
stack backtrace:
   0: rust_begin_unwind
             at /rustc/23e21bdd25026e2839ebe946c2a937c1904887d2/library/std/src/panicking.rs:584:5
   1: core::panicking::panic_fmt
             at /rustc/23e21bdd25026e2839ebe946c2a937c1904887d2/library/core/src/panicking.rs:142:14
   2: core::panicking::panic
             at /rustc/23e21bdd25026e2839ebe946c2a937c1904887d2/library/core/src/panicking.rs:48:5
   3: core::ops::function::FnOnce::call_once
   4: fuel_vm::interpreter::executors::instruction::<impl fuel_vm::interpreter::Interpreter<S>>::_instruction
   5: fuel_vm::interpreter::executors::instruction::<impl fuel_vm::interpreter::Interpreter<S>>::execute
   6: fuel_vm::interpreter::executors::main::<impl fuel_vm::interpreter::Interpreter<S>>::run
   7: fuel_vm::interpreter::executors::main::<impl fuel_vm::interpreter::Interpreter<S>>::transact

GAS_MCLI:

thread '<unnamed>' panicked at 'attempt to multiply with overflow', src/interpreter/gas/consts.rs:92:60
stack backtrace:
   0: rust_begin_unwind
             at /rustc/23e21bdd25026e2839ebe946c2a937c1904887d2/library/std/src/panicking.rs:584:5
   1: core::panicking::panic_fmt
             at /rustc/23e21bdd25026e2839ebe946c2a937c1904887d2/library/core/src/panicking.rs:142:14
   2: core::panicking::panic
             at /rustc/23e21bdd25026e2839ebe946c2a937c1904887d2/library/core/src/panicking.rs:48:5
   3: core::ops::function::FnOnce::call_once
   4: fuel_vm::interpreter::executors::instruction::<impl fuel_vm::interpreter::Interpreter<S>>::_instruction
   5: fuel_vm::interpreter::executors::instruction::<impl fuel_vm::interpreter::Interpreter<S>>::execute
   6: fuel_vm::interpreter::executors::main::<impl fuel_vm::interpreter::Interpreter<S>>::run
   7: fuel_vm::interpreter::executors::main::<impl fuel_vm::interpreter::Interpreter<S>>::transact
   8: fuel_vm::transactor::Transactor<S>::transact
   9: fuel_vm::memory_client::MemoryClient::transact

Here's test cases for both (found with the fuzzing script introduced in #188):

use fuel_vm::prelude::*;

#[test]
fn multiply_with_overflow_gas_mcl() {
    let mut client = MemoryClient::default();

    let gas_price = 0;
    let gas_limit = 100_000;
    let maturity = 0;
    let height = 0;
    let params = ConsensusParameters::DEFAULT;

    let mut tx = Transaction::script(
        gas_price,
        gas_limit,
        maturity,
        vec![],
        vec![
            28,
            84,
            92,
            16,
            39,
            41,
            80,
            0,
        ],
        vec![],
        vec![],
        vec![],
    )
    .check(height, &params)
    .expect("failed to generate a checked tx");

    client.transact(tx);
}

#[test]
fn multiply_with_overflow_gas_mcli() {
    let mut client = MemoryClient::default();

    let gas_price = 0;
    let gas_limit = 100_000;
    let maturity = 0;
    let height = 0;
    let params = ConsensusParameters::DEFAULT;

    let mut tx = Transaction::script(
        gas_price,
        gas_limit,
        maturity,
        vec![],
        vec![
            28,
            255,
            255,
            255,
            112,
            255,
            255,
        ],
        vec![],
        vec![],
        vec![],
    )
    .check(height, &params)
    .expect("failed to generate a checked tx");

    client.transact(tx);
}

cc @vlopes11 @Voxelot

@mediremi mediremi changed the title Overflow in GAS_MCLI Overflow in GAS_MCL and GAS_MCLI Aug 7, 2022
@Voxelot Voxelot added the bug Something isn't working label Aug 8, 2022
@Voxelot
Copy link
Member

Voxelot commented Aug 8, 2022

related: #170

ControlCplusControlV pushed a commit that referenced this issue Nov 24, 2022
ControlCplusControlV pushed a commit that referenced this issue Dec 1, 2022
@mitchmindtree mitchmindtree added the fuel-vm Related to the `fuel-vm` crate. label Dec 9, 2022
xgreenx added a commit that referenced this issue Dec 20, 2022
xgreenx added a commit that referenced this issue Dec 20, 2022
@Dentosal
Copy link
Member

Unable to reproduce anymore. Checked the code around MCL(I) and it isn't doing unchecked arithmetic anymore.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working fuel-vm Related to the `fuel-vm` crate. needs-investigation
Projects
None yet
Development

No branches or pull requests

5 participants