6 ms·
Can someone explain the CVS 2021 46102 bug? Various sources tell me it was an integer overflow in some Rust. The faulty line was: let addr = (sym.st_value
by abainbridge 4y ago
Can someone explain the CVS 2021 46102 bug? Various sources tell me it was an integer overflow in some Rust. The faulty line was:
let addr = (sym.st_value + refd_pa) as u64;
I guess, the + is evaluated using 32-bit arithmetic and then it is cast to a u64, and thus overflow is possible? And in release mode, Rust doesn't trap integer overflow.
Shouldn't something as critical as the EBF compiler be trapping integer overflow?
- password4321 4y agoThey must have enabled trapping integer overflow somehow, unless they were testing with a debug build(?), per https://blocksecteam.medium.com/new-integer-overflow-bug-discovered-in-solana-rbpf-7729717159ee https://blocksecteam.medium.com/new-integer-overflow-bug-dis...: > every validator would run the target ELF file and the rBPF would get panic with “add with overflow” I did not see overflow-checks = true in the cargo.toml though.