Skip to content
This repository has been archived by the owner on Oct 28, 2021. It is now read-only.

BlockHeader fields number & timestamp overflow while converting to RLP #5903

Open
chenxu2048 opened this issue Apr 16, 2020 · 1 comment
Open

Comments

@chenxu2048
Copy link

BugLevel: Tiny
Result: No impact in the near future
Summary: int64_t to unsigned casting while converting to RLP format.


BlockHeader::streamRLP using std::ostream& operator<<(std::ostream& _out, dev::RLP const& _d) to convert block header to RLP. In /libdevcore/RLP.h, it calls RLP::append in function operator <<. And RLP::append has unsigned, u160, u256 and bigint overloading. However, BlockHeader::m_timestamp and BlockHeader::m_number is int64_t which will match RLP::append<unsigned> and maybe cause a casting overflow since unsigned could be 32 bits in some platform.

This overflow could happen after about 150 years 😂.


The testing code could be:

BlockHeader before;
before.setNumber(0x1'0000'0000);
RLPStream ts;
before.streamRLP(ts);
BlockHeader after = BlockHeader(ts.out(), HeaderData);
assert(before == after);

Or a RLP test case:

TEST(RLP, Int64Overflow)
{
    int64_t data = 0x1'0000'0000;
    RLPStream ts;
    ts << data;
    EXPECT_EQ(RLP(ts.out()).toPositiveInt64(), data);
}

Platform: Ubuntu 18.04
Compiler: GCC 7.5.0

@chenxu2048
Copy link
Author

chenxu2048 commented Apr 16, 2020

It seems that there are similar problems in:

  1. dev::p2p::Host::saveNetwork() const
  2. dev::p2p::PingNode::streamRLP(dev::RLPStream&) const
  3. dev::p2p::Pong::streamRLP(dev::RLPStream&) const
  4. void dev::rlpListAux
  5. dev::eth::TransactionBase::streamRLP(dev::RLPStream&, dev::eth::IncludeSignature, bool) const

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant