diff options
author | Martin Holst Swende <martin@swende.se> | 2017-06-28 15:51:31 +0800 |
---|---|---|
committer | Martin Holst Swende <martin@swende.se> | 2017-06-28 15:51:31 +0800 |
commit | bae7565231376bbd23474e2e91c99a21542ef47a (patch) | |
tree | 57619627ef7cbf269cf9c5d1e5c56aa49245186b /core/vm | |
parent | 9e5f03b6c487175cc5aa1224e5e12fd573f483a7 (diff) | |
download | dexon-bae7565231376bbd23474e2e91c99a21542ef47a.tar dexon-bae7565231376bbd23474e2e91c99a21542ef47a.tar.gz dexon-bae7565231376bbd23474e2e91c99a21542ef47a.tar.bz2 dexon-bae7565231376bbd23474e2e91c99a21542ef47a.tar.lz dexon-bae7565231376bbd23474e2e91c99a21542ef47a.tar.xz dexon-bae7565231376bbd23474e2e91c99a21542ef47a.tar.zst dexon-bae7565231376bbd23474e2e91c99a21542ef47a.zip |
core/vm: fix overflow in gas calculation formula
Diffstat (limited to 'core/vm')
-rw-r--r-- | core/vm/gas_table.go | 16 |
1 files changed, 10 insertions, 6 deletions
diff --git a/core/vm/gas_table.go b/core/vm/gas_table.go index 24ad6caa5..761ca4450 100644 --- a/core/vm/gas_table.go +++ b/core/vm/gas_table.go @@ -17,7 +17,6 @@ package vm import ( - gmath "math" "math/big" "github.com/ethereum/go-ethereum/common" @@ -28,15 +27,20 @@ import ( // memoryGasCosts calculates the quadratic gas for memory expansion. It does so // only for the memory region that is expanded, not the total memory. func memoryGasCost(mem *Memory, newMemSize uint64) (uint64, error) { - // The maximum that will fit in a uint64 is max_word_count - 1 - // anything above that will result in an overflow. - if newMemSize > gmath.MaxUint64-32 { - return 0, errGasUintOverflow - } if newMemSize == 0 { return 0, nil } + // The maximum that will fit in a uint64 is max_word_count - 1 + // anything above that will result in an overflow. + // Additionally, a newMemSize which results in a + // newMemSizeWords larger than 0x7ffffffff will cause the square operation + // to overflow. + // The constant 0xffffffffe0 is the highest number that can be used without + // overflowing the gas calculation + if newMemSize > 0xffffffffe0 { + return 0, errGasUintOverflow + } newMemSizeWords := toWordSize(newMemSize) newMemSize = newMemSizeWords * 32 |