diwakergupta / stacks-blockchain-tob-audit

GNU General Public License v3.0
0 stars 0 forks source link

Incomplete error-detection in Clarity REPL prompt #25

Open bradlarsen opened 3 years ago

bradlarsen commented 3 years ago

The Clarity CLI has a read-eval-print loop mode. Its logic that prompts for input to evaluate checks if the prompt-writing operation failed on line 505 of the following:

https://github.com/trailofbits/x-audit-blockstack-core/blob/d35ef465e9fa2ce327a181117f8ca7933b9df075/src/clarity.rs#L503-L518

However, std::io::Write::write method used there doesn't guarantee that the entire buffer is written, and the number of bytes actually written isn't checked. If you want to ensure that, it may be better to use std::io::Write::write_all instead.