Fixed Panic due to out-of-bounds slice access while decoding FixedArray of dynamically sized types

rust-ethereum / ethabi

Encode and decode smart contract invocations

Apache License 2.0

517 stars 186 forks source link

Fixed Panic due to out-of-bounds slice access while decoding FixedArray of dynamically sized types #250

Closed f0rki closed 3 years ago

f0rki commented 3 years ago

I found this via fuzzing and I already had the fix in the PR #221 but it did not receive any attention. So this PR is my next attempt to land this fix. This time with a minimal reproducer testcase. The problem is essentially the same as I fixed in PR #203. When attempting to decode a corrupted FixedArray of a dynamically sized type (e.g., string[5] or uint[5][]) one needs to check whether the offset is legitimate to avoid panicking.

f0rki commented 3 years ago

@vkgnosis sure. pushed.