fix(EVM): Add stack overflow check in dup (#1087)

matter-labs · Dec 6, 2024 · b1e69d0 · b1e69d0
1 parent 5baae31
commit b1e69d0
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/system-contracts/contracts/EvmEmulator.yul b/system-contracts/contracts/EvmEmulator.yul
@@ -476,6 +476,11 @@ object "EvmEmulator" {
 
         function dupStackItem(sp, evmGas, position, oldStackHead) -> newSp, evmGasLeft, stackHead {
             evmGasLeft := chargeGas(evmGas, 3)
+
+            if iszero(lt(sp, MAX_STACK_SLOT_OFFSET())) {
+                panic()
+            }
+
             let tempSp := sub(sp, mul(0x20, sub(position, 1)))
 
             if lt(tempSp, STACK_OFFSET())  {
@@ -3497,6 +3502,11 @@ object "EvmEmulator" {
 
             function dupStackItem(sp, evmGas, position, oldStackHead) -> newSp, evmGasLeft, stackHead {
                 evmGasLeft := chargeGas(evmGas, 3)
+
+                if iszero(lt(sp, MAX_STACK_SLOT_OFFSET())) {
+                    panic()
+                }
+
                 let tempSp := sub(sp, mul(0x20, sub(position, 1)))
 
                 if lt(tempSp, STACK_OFFSET())  {

diff --git a/system-contracts/evm-emulator/EvmEmulatorFunctions.template.yul b/system-contracts/evm-emulator/EvmEmulatorFunctions.template.yul
@@ -414,6 +414,11 @@ function performSystemCallRevertable(to, dataLength) -> success {
 
 function dupStackItem(sp, evmGas, position, oldStackHead) -> newSp, evmGasLeft, stackHead {
     evmGasLeft := chargeGas(evmGas, 3)
+
+    if iszero(lt(sp, MAX_STACK_SLOT_OFFSET())) {
+        panic()
+    }
+
     let tempSp := sub(sp, mul(0x20, sub(position, 1)))
 
     if lt(tempSp, STACK_OFFSET())  {