ralexstokes / ssz-rs

Implementation of ethereum's `ssz`
Apache License 2.0
102 stars 40 forks source link

enhance indexing and arithmetic safety #22

Closed ralexstokes closed 1 year ago

ralexstokes commented 2 years ago

analogues of these:

https://github.com/ralexstokes/ethereum-consensus/issues/151

https://github.com/ralexstokes/ethereum-consensus/issues/152

for this repo :)

claravanstaden commented 1 year ago

Hey @ralexstokes! As part of our production readiness of https://github.com/Snowfork/snowbridge I will be taking a look at these.

ralexstokes commented 1 year ago

@0xTylerHolmes found a panic here :)

use ssz_rs::prelude::*;

type Bar = Vector<u8, 96>;

#[derive(PartialEq, Eq, Debug, Default, Clone, SimpleSerialize)]
pub struct Foo {
    pub bar: Bar,
}

fn main() {
    let data = vec![];
    let foo = Foo::deserialize(&data);
    dbg!(foo);
}

and what fails is this: https://github.com/ralexstokes/ssz-rs/blob/main/ssz-rs-derive/src/lib.rs#L202 where the range on encoding hits out of bounds

instead, we should use https://doc.rust-lang.org/std/vec/struct.Vec.html#method.get

and note to whoever fixes this: we should also review all of the direct indexing ops and switch to get

ralexstokes commented 1 year ago

this should be addressed by all of the work linked here once #57 is merged

great work everyone and thank you all SO much for improving this library