Merge pull request #10611 from ethereum/fix-10609

chriseth · web-flow · commit 1521e9e4d52f · 2020-12-15T16:42:27.000+01:00
AsmAnalysis: Fix out of bounds read due to incorrect bounds checking …
diff --git a/libyul/AsmAnalysis.cpp b/libyul/AsmAnalysis.cpp
@@ -332,7 +332,11 @@ vector<YulString> AsmAnalyzer::operator()(FunctionCall const& _funCall)
 	for (size_t i = _funCall.arguments.size(); i > 0; i--)
 	{
 		Expression const& arg = _funCall.arguments[i - 1];
-		if (auto literalArgumentKind = literalArguments ? literalArguments->at(i - 1) : std::nullopt)
+		if (
+			auto literalArgumentKind = (literalArguments && i <= literalArguments->size()) ?
+				literalArguments->at(i - 1) :
+				std::nullopt
+		)
 		{
 			if (!holds_alternative<Literal>(arg))
 				m_errorReporter.typeError(
diff --git a/test/libyul/yulSyntaxTests/function_literal.yul b/test/libyul/yulSyntaxTests/function_literal.yul
@@ -0,0 +1,6 @@
+{
+  function f(a,b) {}
+  f(x,1)
+}
+// ----
+// DeclarationError 8198: (27-28): Identifier not found.
diff --git a/test/libyul/yulSyntaxTests/function_literal_valid.yul b/test/libyul/yulSyntaxTests/function_literal_valid.yul
@@ -0,0 +1,6 @@
+{
+  let x
+  function f(a,b) {}
+  f(x,1)
+}
+// ----

Original file line number	Diff line number	Diff line change
`@@ -332,7 +332,11 @@ vector<YulString> AsmAnalyzer::operator()(FunctionCall const& _funCall)`
`332`	`332`	`for (size_t i = _funCall.arguments.size(); i > 0; i--)`
`333`	`333`	`{`
`334`	`334`	`Expression const& arg = _funCall.arguments[i - 1];`
`335`		`- if (auto literalArgumentKind = literalArguments ? literalArguments->at(i - 1) : std::nullopt)`
	`335`	`+ if (`
	`336`	`+ auto literalArgumentKind = (literalArguments && i <= literalArguments->size()) ?`
	`337`	`+ literalArguments->at(i - 1) :`
	`338`	`+ std::nullopt`
	`339`	`+ )`
`336`	`340`	`{`
`337`	`341`	`if (!holds_alternative<Literal>(arg))`
`338`	`342`	`m_errorReporter.typeError(`
-Original file line number
+Diff line change
@@ @@ -0,0 +1,6 @@ @@
 +{
 +  function f(a,b) {}
 +  f(x,1)
 +}
 +// ----
 +// DeclarationError 8198: (27-28): Identifier not found.