fix(vm): CODECOPY, CALLDATACOPY, MCOPY size clamping (#572)

Author: Jon-Becker

crates/core/tests/test_decompile.rs

@@ -39,13 +39,13 @@ mod integration_tests {
     }
 
     #[tokio::test]
-    async fn test_decompile_u256_conversion_overflow_1() {
+    async fn test_decompile_edge_case_u256_conversion_overflow_1() {
         let rpc_url = std::env::var("RPC_URL").unwrap_or_else(|_| {
             println!("RPC_URL not set, skipping test");
             std::process::exit(0);
         });
 
-        let result = decompile(DecompilerArgs {
+        let _ = decompile(DecompilerArgs {
             target: String::from("0x914d7Fec6aaC8cd542e72Bca78B30650d45643d7"),
             rpc_url,
             default: true,
@@ -64,13 +64,13 @@ mod integration_tests {
     }
 
     #[tokio::test]
-    async fn test_decompile_u256_conversion_overflow_2() {
+    async fn test_decompile_edge_case_u256_conversion_overflow_2() {
         let rpc_url = std::env::var("RPC_URL").unwrap_or_else(|_| {
             println!("RPC_URL not set, skipping test");
             std::process::exit(0);
         });
 
-        let result = decompile(DecompilerArgs {
+        let _ = decompile(DecompilerArgs {
             target: String::from("0x5141b82f5ffda4c6fe1e372978f1c5427640a190"),
             rpc_url,
             default: true,
@@ -88,6 +88,31 @@ mod integration_tests {
         .expect("failed to decompile");
     }
 
+    #[tokio::test]
+    async fn test_decompile_edge_case_vec_overflow() {
+        let rpc_url = std::env::var("RPC_URL").unwrap_or_else(|_| {
+            println!("RPC_URL not set, skipping test");
+            std::process::exit(0);
+        });
+
+        let _ = decompile(DecompilerArgs {
+            target: String::from("0x8579970692bf77fafeeb017f07dec9a8fdb4893d"),
+            rpc_url,
+            default: true,
+            skip_resolving: true,
+            include_solidity: true,
+            include_yul: false,
+            output: String::from(""),
+            name: String::from(""),
+            timeout: 10000,
+            abi: None,
+            openai_api_key: String::from(""),
+            llm_postprocess: false,
+        })
+        .await
+        .expect("failed to decompile");
+    }
+
     #[tokio::test]
     async fn test_decompile_weth() {
         let rpc_url = std::env::var("RPC_URL").unwrap_or_else(|_| {

crates/vm/src/core/vm.rs

@@ -908,7 +908,7 @@ impl VM {
                 // Safely convert U256 to usize, clamping to calldata length
                 let dest_offset: usize = dest_offset.try_into().unwrap_or(usize::MAX);
                 let offset: usize = offset.try_into().unwrap_or(usize::MAX);
-                let size: usize = size.try_into().unwrap_or(usize::MAX);
+                let size: usize = size.try_into().unwrap_or(self.calldata.len());
 
                 // clamp values to calldata length
                 let end_offset_clamped = offset.saturating_add(size).min(self.calldata.len());
@@ -952,7 +952,7 @@ impl VM {
                 // Safely convert U256 to usize, clamping to bytecode length
                 let dest_offset: usize = dest_offset.try_into().unwrap_or(usize::MAX);
                 let offset: usize = offset.try_into().unwrap_or(usize::MAX);
-                let size: usize = size.try_into().unwrap_or(usize::MAX);
+                let size: usize = size.try_into().unwrap_or(self.bytecode.len());
 
                 // clamp values to bytecode length
                 let value_offset_safe = offset.saturating_add(size).min(self.bytecode.len());
@@ -1270,7 +1270,9 @@ impl VM {
                 // Safely convert U256 to usize, clamping to memory length
                 let dest_offset: usize = dest_offset.try_into().unwrap_or(u128::MAX as usize);
                 let offset: usize = offset.try_into().unwrap_or(u128::MAX as usize);
-                let size: usize = size.try_into().unwrap_or(u128::MAX as usize);
+                let size: usize = size.try_into().unwrap_or(
+                    self.memory.size().try_into().expect("failed to convert u128 to usize"),
+                );
                 let value_offset_safe = offset
                     .saturating_add(size)
                     .min(self.memory.size().try_into().expect("failed to convert u128 to usize"));