search

starcoinorg / starcoin

Starcoin - A Move smart contract blockchain network that scales by layering
Apache License 2.0
1.38k stars 289 forks source link

漏洞：attempt to subtract with overflow #2101

Closed tiangong3624749 closed 3 years ago

tiangong3624749 commented 3 years ago

panic occurred: details: panicked at 'attempt to subtract with overflow', sync/src/tasks/accumulator_sync_task.rs:78:14 backtrace: 0: 0x111f1fb9a - backtrace::backtrace::libunwind::trace::h5fed1b184bd94099 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.55/src/backtrace/libunwind.rs:90:5 backtrace::backtrace::trace_unsynchronized::hc96229322fab81c1 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.55/src/backtrace/mod.rs:66:5 1: 0x111f1fb28 - backtrace::backtrace::trace::h6fc4df531300a842 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.55/src/backtrace/mod.rs:53:14 2: 0x111f6a68a - backtrace::capture::Backtrace::create::h5787f8ff0a3103de at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.55/src/capture.rs:176:9 3: 0x111f6a5bf - backtrace::capture::Backtrace::new::h2185d29be787857d at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.55/src/capture.rs:140:22 4: 0x10db39943 - starcoin_node::crash_handler::handle_panic::hb8cca8e4516b0cf8 at /Users/dqm/workspace/starcoin/node/src/crash_handler.rs:21:38 5: 0x10db19308 - starcoin_node::crash_handler::setup_panic_handler::{{closure}}::hd0208bcb6b53c1ab at /Users/dqm/workspace/starcoin/node/src/crash_handler.rs:14:9 6: 0x1121df80e - std::panicking::rust_panic_with_hook::h76436d4cf7a368ac at /rustc/e1884a8e3c3e813aada8254edfa120e85bf5ffca/library/std/src/panicking.rs:597:17 7: 0x1121df2e9 - std::panicking::begin_panic_handler::{{closure}}::h516c76d70abf04f6 at /rustc/e1884a8e3c3e813aada8254edfa120e85bf5ffca/library/std/src/panicking.rs:497:13 8: 0x1121dd128 - std::sys_common::backtrace::__rust_end_short_backtrace::h653290b4f930faed at /rustc/e1884a8e3c3e813aada8254edfa120e85bf5ffca/library/std/src/sys_common/backtrace.rs:141:18 9: 0x1121df27a - rust_begin_unwind at /rustc/e1884a8e3c3e813aada8254edfa120e85bf5ffca/library/std/src/panicking.rs:495:5 10: 0x11223682f - core::panicking::panic_fmt::hde9134dd19c9a74f at /rustc/e1884a8e3c3e813aada8254edfa120e85bf5ffca/library/core/src/panicking.rs:92:14 11: 0x112236787 - core::panicking::panic::hd1044393afd25972 at /rustc/e1884a8e3c3e813aada8254edfa120e85bf5ffca/library/core/src/panicking.rs:50:5 12: 0x10de80ce5 - ::total_items::h660811d836af2275 at /Users/dqm/workspace/starcoin/sync/src/tasks/accumulator_sync_task.rs:78:14 13: 0x10de8344c - stream_task::generator::TaskGenerator<S,C as stream_task::generator::Generator>::generate::{{closure}}::h79813574e7dff6bf at /Users/dqm/workspace/starcoin/commons/stream-task/src/generator.rs:143:30 14: 0x10de120fc - core::future::from_generator::GenFuture::poll::h60c4711714423ff3 at /Users/dqm/.rustup/toolchains/1.49.0-x86_64-apple-darwin/lib/rustlib/src/rust/library/core/src/future/mod.rs:80:19 15: 0x10de765fd - core::pin::Pin

::poll::hd96e0d32bc63cfff at /Users/dqm/.rustup/toolchains/1.49.0-x86_64-apple-darwin/lib/rustlib/src/rust/library/core/src/future/future.rs:119:9 16: 0x10de87351 - stream_task::generator::TaskFuture::poll::ha8949bd4cc5b4d9b at /Users/dqm/workspace/starcoin/commons/stream-task/src/generator.rs:74:9 17: 0x10de86d8c - ::try_poll::h08edb79b7d8e2664 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-core-0.3.11/src/future.rs:83:9 18: 0x10de79f4c - futures_util::future::try_future::into_future::IntoFuture::poll::h4261a4264784200c at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/future/try_future/into_future.rs:35:9 19: 0x10de88999 - futures_util::future::future::map::Map<Fut,F as core::future::future::Future>::poll::he6279f5b3a302d36 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/future/future/map.rs:55:37 20: 0x10de1747c - futures_util::future::future::Map<Fut,F as core::future::future::Future>::poll::h7a86b6dcce615d99 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/lib.rs:102:13 21: 0x10deb275c - futures_util::future::try_future::MapOk<Fut,F as core::future::future::Future>::poll::h43bead3e8c8d20a9 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/lib.rs:102:13 22: 0x10deb3dbc - ::try_poll::hdb492c6213cfcaf1 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-core-0.3.11/src/future.rs:83:9 23: 0x10dd6db49 - <futures_util::future::try_future::try_flatten::TryFlatten<Fut,::Ok> as core::future::future::Future>::poll::hd06c2553bc8bbccf at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/future/try_future/try_flatten.rs:48:34 24: 0x10deb298c - futures_util::future::try_future::TryFlatten<Fut1,Fut2 as core::future::future::Future>::poll::h8e661b62ce805193 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/lib.rs:102:13 25: 0x10deb2b6c - futures_util::future::try_future::AndThen<Fut1,Fut2,F as core::future::future::Future>::poll::hce0a4083c380a609 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/lib.rs:102:13 26: 0x10deb3d8c - ::try_poll::hcfd5be7521a8c0e0 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-core-0.3.11/src/future.rs:83:9 27: 0x10de79f9c - futures_util::future::try_future::into_future::IntoFuture::poll::h5dd9bfb669f5811f at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/future/try_future/into_future.rs:35:9 28: 0x10de87429 - futures_util::future::future::map::Map<Fut,F as core::future::future::Future>::poll::h1675e01048951e57 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/future/future/map.rs:55:37 29: 0x10de1760c - futures_util::future::future::Map<Fut,F as core::future::future::Future>::poll::hfe41b8bcee54dec6 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/lib.rs:102:13 30: 0x10deb284c - futures_util::future::try_future::MapOk<Fut,F as core::future::future::Future>::poll::hd9ecbde60bd452d6 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/lib.rs:102:13 31: 0x10deb3ccc - ::try_poll::h1362505bbc841e0b at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-core-0.3.11/src/future.rs:83:9 32: 0x10dd6c4e9 - <futures_util::future::try_future::try_flatten::TryFlatten<Fut,::Ok> as core::future::future::Future>::poll::h371e770bb859b1a5 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/future/try_future/try_flatten.rs:48:34 33: 0x10deb28ec - futures_util::future::try_future::TryFlatten<Fut1,Fut2 as core::future::future::Future>::poll::h1ca1618c4291e2bb at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/lib.rs:102:13 34: 0x10deb2a2c - futures_util::future::try_future::AndThen<Fut1,Fut2,F as core::future::future::Future>::poll::h13b425d89cb60a7d at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/lib.rs:102:13 35: 0x10de7641d - core::pin::Pin

::poll::h5d90c295346a2416 at /Users/dqm/.rustup/toolchains/1.49.0-x86_64-apple-darwin/lib/rustlib/src/rust/library/core/src/future/future.rs:119:9 36: 0x10de909ae - futures_util::future::abortable::Abortable::poll::ha41ecc404582df17 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/future/abortable.rs:146:33 37: 0x10de88f59 - futures_util::future::future::map::Map<Fut,F as core::future::future::Future>::poll::hedccdbe00b5c24c9 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/future/future/map.rs:55:37 38: 0x10de172ec - futures_util::future::future::Map<Fut,F as core::future::future::Future>::poll::h080f964d37e097b7 at /Users/dqm/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-util-0.3.11/src/lib.rs:102:13 39: 0x10de7641d - core::pin::Pin

::poll::h5d90c295346a2416

tiangong3624749 commented 3 years ago

通过构造假的total difficulty，保证同步target的number比共同祖先的number低，就一定会panic；