Skip to content

callTracer crashes when withLog=true #26845

@zzh1996

Description

@zzh1996

System information

Geth version: v1.11.3

Steps to reproduce the behaviour

Example 1:

{"jsonrpc":"2.0","id":1,"method":"debug_traceCall","params":[{"data":"0xA4"}, "latest",{"tracer":"callTracer","tracerConfig":{"withLog":true}}]}

This bytecode caused a stack overflow at https://github.com/ethereum/go-ethereum/blob/v1.11.3/eth/tracers/native/call.go#L171

Example 2:

{"jsonrpc":"2.0","id":1,"method":"debug_traceCall","params":[{"data":"0x600160005260ff6000A0"}, "latest",{"tracer":"callTracer","tracerConfig":{"withLog":true}}]}

This bytecode caused out-of-range memory read (because CaptureState is called before memory expansion) at https://github.com/ethereum/go-ethereum/blob/v1.11.3/eth/tracers/native/call.go#L179

I suspect that this line will also cause the same issue but I didn't test: https://github.com/ethereum/go-ethereum/blob/v1.11.3/eth/tracers/native/prestate.go#L161

Edit: prestate tracer also has this issue:

{"jsonrpc":"2.0","id":1,"method":"debug_traceCall","params":[{"data":"0x6001600052600060ff60006000F5"}, "latest",{"tracer":"prestateTracer"}]}

Please make sure that all stack and memory reads are checked in all tracers and please add tests for these corner cases.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions