Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

missing input validation for arith overflow #46

Open
bennetyee opened this issue Nov 8, 2018 · 2 comments
Open

missing input validation for arith overflow #46

bennetyee opened this issue Nov 8, 2018 · 2 comments

Comments

@bennetyee
Copy link
Member

https://github.com/oasislabs/parity/blob/80238a2bc4af5026c3e4e55570de85e916a6223f/ethcore/wasm/src/env.rs#L231

u32.max_value() should be illegal here for max_memory due to arithmetic overflow later. Because <u32>::max_value() - 1 was used at the call site at lib.rs, it made it obvious that there are landmines here.

@bennetyee bennetyee changed the title missing input validation for arth overflow missing input validation for arith overflow Nov 8, 2018
@willscott
Copy link

Is this still a problem that needs to be fixed, @nhynes?

@nhynes
Copy link
Contributor

nhynes commented Jul 15, 2019

Yeah the - 1 spurious. It's benign, though. Of course, the whole thing will abort if the host machine ooms, but that should be handled by the scheduler. How does the scheduler even know how much memory an invocation will use?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants