Skip to content

fix(store): prevent delete out of bounds in spliceDynamicData #3521

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Mar 17, 2025
Merged

fix(store): prevent delete out of bounds in spliceDynamicData #3521

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3da3cd3
pin foundry version
alvrs Mar 17, 2025
f290e6a
add failing test
alvrs Jan 28, 2025
5027f3e
add patch
alvrs Jan 28, 2025
1fe5078
update snapshots
alvrs Mar 17, 2025
1a15f90
update snapshots
alvrs Mar 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/actions/setup-prerequisites/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,4 @@ runs:
- name: Setup foundry
uses: foundry-rs/foundry-toolchain@v1
with:
version: nightly
version: nightly-f47d7e0c29a36372908b917cd74aa589d5888f8e
4 changes: 2 additions & 2 deletions packages/store/src/StoreCore.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1003,8 +1003,8 @@ library StoreCoreInternal {
}

// The start index can't be larger than the previous length of the field
if (startWithinField > previousFieldLength) {
revert IStoreErrors.Store_IndexOutOfBounds(previousFieldLength, startWithinField);
if (startWithinField > previousFieldLength - deleteCount) {
revert IStoreErrors.Store_IndexOutOfBounds(previousFieldLength - deleteCount, startWithinField);
}

// Update the encoded length
Expand Down
19 changes: 18 additions & 1 deletion packages/store/test/StoreCore.t.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1023,7 +1023,7 @@ contract StoreCoreTest is Test, StoreMock {
vm.expectRevert(
abi.encodeWithSelector(
IStoreErrors.Store_IndexOutOfBounds.selector,
data.newThirdDataBytes.length,
data.newThirdDataBytes.length - uint40(data.thirdDataForUpdate.length),
uint40(type(uint56).max)
)
);
Expand All @@ -1035,6 +1035,23 @@ contract StoreCoreTest is Test, StoreMock {
uint40(data.thirdDataForUpdate.length),
data.thirdDataForUpdate
);

// startByteIndex + deleteCount must not overflow
vm.expectRevert(
abi.encodeWithSelector(
IStoreErrors.Store_IndexOutOfBounds.selector,
data.newThirdDataBytes.length - 8,
data.newThirdDataBytes.length
)
);
this.spliceDynamicData(
data.tableId,
data.keyTuple,
1,
uint40(data.newThirdDataBytes.length), // set start to end of the field
uint40(8), // delete 8 bytes (after the start index, so after the size of the field)
abi.encodePacked(uint64(1)) // append 8 bytes
);
}

function testAccessEmptyData() public {
Expand Down
20 changes: 10 additions & 10 deletions packages/store/ts/flattenStoreLogs.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,10 +53,10 @@ describe("flattenStoreLogs", async () => {
"Store_SetRecord store__ResourceIds (0x6e73000000000000000000000000000000000000000000000000000000000000)",
"Store_SetRecord store__ResourceIds (0x6e7373746f726500000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__NamespaceOwner (0x6e7373746f726500000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__ResourceAccess (0x6e7373746f726500000000000000000000000000000000000000000000000000,0x0000000000000000000000008dc4168dc8e582f0ef5adbab3c0873856682639b)",
"Store_SetRecord world__ResourceAccess (0x6e7373746f726500000000000000000000000000000000000000000000000000,0x000000000000000000000000e244df0041ee77b1f0cda4155879ba8e338ed23b)",
"Store_SetRecord store__ResourceIds (0x6e73776f726c6400000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__NamespaceOwner (0x6e73776f726c6400000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__ResourceAccess (0x6e73776f726c6400000000000000000000000000000000000000000000000000,0x0000000000000000000000008dc4168dc8e582f0ef5adbab3c0873856682639b)",
"Store_SetRecord world__ResourceAccess (0x6e73776f726c6400000000000000000000000000000000000000000000000000,0x000000000000000000000000e244df0041ee77b1f0cda4155879ba8e338ed23b)",
"Store_SetRecord store__ResourceIds (0x737900000000000000000000000000004163636573734d616e6167656d656e74)",
"Store_SetRecord world__Systems (0x737900000000000000000000000000004163636573734d616e6167656d656e74)",
"Store_SetRecord world__SystemRegistry (0x00000000000000000000000073e872dcf77241b6d2afe4169ac27f9d31767292)",
Expand All @@ -71,8 +71,8 @@ describe("flattenStoreLogs", async () => {
"Store_SetRecord world__ResourceAccess (0x6e73000000000000000000000000000000000000000000000000000000000000,0x0000000000000000000000002aac36425e74ff6c0778da582c55176394a067b0)",
"Store_SetRecord store__ResourceIds (0x73790000000000000000000000000000526567697374726174696f6e00000000)",
"Store_SetRecord world__Systems (0x73790000000000000000000000000000526567697374726174696f6e00000000)",
"Store_SetRecord world__SystemRegistry (0x000000000000000000000000047f80b91559887ab304519858c0bce90f2a00a6)",
"Store_SetRecord world__ResourceAccess (0x6e73000000000000000000000000000000000000000000000000000000000000,0x000000000000000000000000047f80b91559887ab304519858c0bce90f2a00a6)",
"Store_SetRecord world__SystemRegistry (0x0000000000000000000000009fd59d184a359e7f14590d68fd08e57e4d9fded5)",
"Store_SetRecord world__ResourceAccess (0x6e73000000000000000000000000000000000000000000000000000000000000,0x0000000000000000000000009fd59d184a359e7f14590d68fd08e57e4d9fded5)",
"Store_SetRecord world__FunctionSelector (0x40554c3a00000000000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__FunctionSignatur (0x40554c3a00000000000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__FunctionSelector (0x8d53b20800000000000000000000000000000000000000000000000000000000)",
Expand Down Expand Up @@ -117,7 +117,7 @@ describe("flattenStoreLogs", async () => {
"Store_SetRecord world__FunctionSignatur (0xbfdfaff700000000000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__FunctionSelector (0xaa66e9c800000000000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__FunctionSignatur (0xaa66e9c800000000000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__InstalledModules (0x0000000000000000000000009fcc45958071325949b488a784268371f17cb2d7,0xc5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470)",
"Store_SetRecord world__InstalledModules (0x000000000000000000000000e4928465c9808ba23b78452855ac2018242abb35,0xc5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470)",
"Store_SetRecord world__NamespaceOwner (0x6e73000000000000000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__ResourceAccess (0x6e73000000000000000000000000000000000000000000000000000000000000,0x000000000000000000000000f39fd6e51aad88f6f4ce6ab8827279cfffb92266)",
"Store_SetRecord store__Tables (0x74620000000000000000000000000000506f736974696f6e0000000000000000)",
Expand All @@ -134,8 +134,8 @@ describe("flattenStoreLogs", async () => {
"Store_SetRecord store__ResourceIds (0x746200000000000000000000000000005465727261696e000000000000000000)",
"Store_SetRecord store__ResourceIds (0x737900000000000000000000000000004d6f766553797374656d000000000000)",
"Store_SetRecord world__Systems (0x737900000000000000000000000000004d6f766553797374656d000000000000)",
"Store_SetRecord world__SystemRegistry (0x000000000000000000000000cbcdc66f9301ccf30b6b46efba8a3015d332dc13)",
"Store_SetRecord world__ResourceAccess (0x6e73000000000000000000000000000000000000000000000000000000000000,0x000000000000000000000000cbcdc66f9301ccf30b6b46efba8a3015d332dc13)",
"Store_SetRecord world__SystemRegistry (0x0000000000000000000000003e68253943ba3065f212dba41669e9cf47566956)",
"Store_SetRecord world__ResourceAccess (0x6e73000000000000000000000000000000000000000000000000000000000000,0x0000000000000000000000003e68253943ba3065f212dba41669e9cf47566956)",
"Store_SetRecord world__FunctionSelector (0xb591186e00000000000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__FunctionSignatur (0xb591186e00000000000000000000000000000000000000000000000000000000)",
"Store_SetRecord store__Tables (0x7462000000000000000000000000000043616c6c576974685369676e61747572)",
Expand All @@ -154,8 +154,8 @@ describe("flattenStoreLogs", async () => {
"Store_SetRecord store__ResourceIds (0x74626d657461646174610000000000005265736f757263655461670000000000)",
"Store_SetRecord store__ResourceIds (0x73796d657461646174610000000000004d6574616461746153797374656d0000)",
"Store_SetRecord world__Systems (0x73796d657461646174610000000000004d6574616461746153797374656d0000)",
"Store_SetRecord world__SystemRegistry (0x00000000000000000000000077c97a668f68dc030a3688fb7655780a1d800f95)",
"Store_SetRecord world__ResourceAccess (0x6e736d6574616461746100000000000000000000000000000000000000000000,0x00000000000000000000000077c97a668f68dc030a3688fb7655780a1d800f95)",
"Store_SetRecord world__SystemRegistry (0x000000000000000000000000443ae8e9e5c698a141c400b5d1ee6b4264f1fdc2)",
"Store_SetRecord world__ResourceAccess (0x6e736d6574616461746100000000000000000000000000000000000000000000,0x000000000000000000000000443ae8e9e5c698a141c400b5d1ee6b4264f1fdc2)",
"Store_SetRecord world__FunctionSelector (0xff66f05f00000000000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__FunctionSignatur (0xc6972e9300000000000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__FunctionSignatur (0xff66f05f00000000000000000000000000000000000000000000000000000000)",
Expand All @@ -165,7 +165,7 @@ describe("flattenStoreLogs", async () => {
"Store_SetRecord world__FunctionSelector (0x5ce7ca1a00000000000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__FunctionSignatur (0xf128760200000000000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__FunctionSignatur (0x5ce7ca1a00000000000000000000000000000000000000000000000000000000)",
"Store_SetRecord world__InstalledModules (0x0000000000000000000000004eb6f2596d44971d7d8065669c5bdba0a77e76a9,0xc5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470)",
"Store_SetRecord world__InstalledModules (0x000000000000000000000000c8606bdf3035f73cf194f458e28b1d1f5ea161b3,0xc5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470)",
"Store_SetRecord metadata__ResourceTag (0x737900000000000000000000000000004d6f766553797374656d000000000000,0x6162690000000000000000000000000000000000000000000000000000000000)",
"Store_SetRecord metadata__ResourceTag (0x737900000000000000000000000000004d6f766553797374656d000000000000,0x776f726c64416269000000000000000000000000000000000000000000000000)",
"Store_SetRecord Position (0x0000000000000000000000001d96f2f6bef1202e4ce1ff6dad0c2cb002861d3e)",
Expand Down
Loading
Loading