Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Memory overflow in LFVM found with fuzzing #552

Closed
LuisPH3 opened this issue Jun 24, 2024 · 1 comment
Closed

Memory overflow in LFVM found with fuzzing #552

LuisPH3 opened this issue Jun 24, 2024 · 1 comment
Labels
CT test candidate Try undo this change to try to find it with CT framework
Milestone

Comments

@LuisPH3
Copy link
Contributor

LuisPH3 commented Jun 24, 2024

The following command failed, (reproducible once #547 is merged or with dev branch):

~/code/Tosca$ go test ./go/ct/evm_fuzz_test.go 
--- FAIL: FuzzDifferentialLfvmVsGeth (0.13s)
   --- FAIL: FuzzDifferentialLfvmVsGeth/23bc1d2336dd2e5b (0.00s)
panic: runtime error: growslice: len out of range [recovered]
   panic: runtime error: growslice: len out of range

goroutine 27766 [running]:
testing.tRunner.func1.2({0x6f5a20, 0x853eb0})
   /snap/go/10630/src/testing/testing.go:1631 +0x24a
testing.tRunner.func1()
   /snap/go/10630/src/testing/testing.go:1634 +0x377
panic({0x6f5a20?, 0x853eb0?})
   /snap/go/10630/src/runtime/panic.go:770 +0x132
github.com/Fantom-foundation/Tosca/go/vm/lfvm.(*Memory).EnsureCapacity(0xc005d48e80, 0xc005d3f8c0?, 0xc00a1070a8?, 0xc005d3f8c8)
   /home/luis/code/Tosca/go/vm/lfvm/memory.go:96 +0x111
github.com/Fantom-foundation/Tosca/go/vm/lfvm.getResult(0xc005d3f8c8)
   /home/luis/code/Tosca/go/vm/lfvm/interpreter.go:200 +0xa5
github.com/Fantom-foundation/Tosca/go/vm/lfvm.ctAdapter.StepN({}, 0xc005d80600, 0x1)
   /home/luis/code/Tosca/go/vm/lfvm/ct.go:91 +0x5da
command-line-arguments_test.differentialFuzz.func1(0xc005d50820, {0xc0092df2f0?, 0x1, 0xc00a1077d0?}, 0x4c9f78?, 0x0?, {0xc0092e5650?, 0x0?, 0x0?})
   /home/luis/code/Tosca/go/ct/evm_fuzz_test.go:92 +0x1f7
reflect.Value.call({0x6f71c0?, 0xc008bb88a0?, 0x13?}, {0x7452b1, 0x4}, {0xc005d46900, 0x5, 0x8?})
   /snap/go/10630/src/reflect/value.go:596 +0xca6
reflect.Value.Call({0x6f71c0?, 0xc008bb88a0?, 0x4f9acd?}, {0xc005d46900?, 0x743fc0?, 0xf?})
   /snap/go/10630/src/reflect/value.go:380 +0xb9
testing.(*F).Fuzz.func1.1(0xc005d50820?)
   /snap/go/10630/src/testing/fuzz.go:335 +0x325
testing.tRunner(0xc005d50820, 0xc005d44360)
   /snap/go/10630/src/testing/testing.go:1689 +0xfb
created by testing.(*F).Fuzz.func1 in goroutine 18506
   /snap/go/10630/src/testing/fuzz.go:322 +0x574
FAIL	command-line-arguments	0.376s
FAIL

An early presumption is that the gas computation failed and did not prevent a very large memory use. Geth executes the input data correctly.

@LuisPH3 LuisPH3 added this to the Release Ready milestone Jun 24, 2024
@LuisPH3 LuisPH3 added the CT test candidate Try undo this change to try to find it with CT framework label Jun 24, 2024
@facuMH
Copy link
Contributor

facuMH commented Jul 11, 2024

as of commit 2f165a0d44da026e5cff15cb95f36701257adb52 running

go test ./go/ct/evm_fuzz_test.go
ok      command-line-arguments  0.873s

So if the original assumption was correct, this has been fixed by #541 and #545

@facuMH facuMH closed this as completed Jul 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
CT test candidate Try undo this change to try to find it with CT framework
Projects
None yet
Development

No branches or pull requests

2 participants