-
-
Notifications
You must be signed in to change notification settings - Fork 871
fix[codegen]: disable augassign with overlap #4487
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix[codegen]: disable augassign with overlap #4487
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #4487 +/- ##
=======================================
Coverage 92.06% 92.06%
=======================================
Files 120 120
Lines 17330 17335 +5
Branches 2932 2935 +3
=======================================
+ Hits 15955 15960 +5
Misses 957 957
Partials 418 418 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| if var.typ._is_prim_word: | ||
| continue | ||
| # oob - GHSA-4w26-8p97-f4jp | ||
| if var in right.variable_writes or right.contains_risky_call: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
staticall probably isn't risky for this case. but i don't think it matters that much
…sign-oob add tests
in vyper, the behavior for AugAssign is to perform the bounds checks
only before evaluation of the rhs, rather than before-and-after. in
other words, the following code:
```vyper
def poc():
a: DynArray[uint256, 2] = [1, 2]
a[1] += a.pop()
```
is equivalent to:
```vyper
def poc():
a: DynArray[uint256, 2] = [1, 2]
a[1] += a[len(a) - 1]
a.pop()
```
rather than:
```vyper
def poc():
a: DynArray[uint256, 2] = [1, 2]
s: uint256 = a[1]
t: uint256 = a.pop()
a[1] = s + t # reverts due to oob access
```
this commit blocks the potentially missing bounds check by panicking
when there is a potential write on the rhs of an AugAssign which could
change the length on the lhs.
references:
- GHSA-4w26-8p97-f4jp
---------
Co-authored-by: cyberthirst <[email protected]>
What I did
mitigating PR for GHSA-4w26-8p97-f4jp (tracking issue: #4489). block the behavior
How I did it
How to verify it
Commit message
Description for the changelog
Cute Animal Picture