aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMartin Holst Swende <martin@swende.se>2017-06-28 15:51:31 +0800
committerMartin Holst Swende <martin@swende.se>2017-06-28 15:51:31 +0800
commitbae7565231376bbd23474e2e91c99a21542ef47a (patch)
tree57619627ef7cbf269cf9c5d1e5c56aa49245186b
parent9e5f03b6c487175cc5aa1224e5e12fd573f483a7 (diff)
downloadgo-tangerine-bae7565231376bbd23474e2e91c99a21542ef47a.tar
go-tangerine-bae7565231376bbd23474e2e91c99a21542ef47a.tar.gz
go-tangerine-bae7565231376bbd23474e2e91c99a21542ef47a.tar.bz2
go-tangerine-bae7565231376bbd23474e2e91c99a21542ef47a.tar.lz
go-tangerine-bae7565231376bbd23474e2e91c99a21542ef47a.tar.xz
go-tangerine-bae7565231376bbd23474e2e91c99a21542ef47a.tar.zst
go-tangerine-bae7565231376bbd23474e2e91c99a21542ef47a.zip
core/vm: fix overflow in gas calculation formula
-rw-r--r--core/vm/gas_table.go16
1 files changed, 10 insertions, 6 deletions
diff --git a/core/vm/gas_table.go b/core/vm/gas_table.go
index 24ad6caa5..761ca4450 100644
--- a/core/vm/gas_table.go
+++ b/core/vm/gas_table.go
@@ -17,7 +17,6 @@
package vm
import (
- gmath "math"
"math/big"
"github.com/ethereum/go-ethereum/common"
@@ -28,15 +27,20 @@ import (
// memoryGasCosts calculates the quadratic gas for memory expansion. It does so
// only for the memory region that is expanded, not the total memory.
func memoryGasCost(mem *Memory, newMemSize uint64) (uint64, error) {
- // The maximum that will fit in a uint64 is max_word_count - 1
- // anything above that will result in an overflow.
- if newMemSize > gmath.MaxUint64-32 {
- return 0, errGasUintOverflow
- }
if newMemSize == 0 {
return 0, nil
}
+ // The maximum that will fit in a uint64 is max_word_count - 1
+ // anything above that will result in an overflow.
+ // Additionally, a newMemSize which results in a
+ // newMemSizeWords larger than 0x7ffffffff will cause the square operation
+ // to overflow.
+ // The constant 0xffffffffe0 is the highest number that can be used without
+ // overflowing the gas calculation
+ if newMemSize > 0xffffffffe0 {
+ return 0, errGasUintOverflow
+ }
newMemSizeWords := toWordSize(newMemSize)
newMemSize = newMemSizeWords * 32