fix: Addition overflows

nervosnetwork · Dec 15, 2023 · d09434a · d09434a
1 parent 768347f
commit d09434a
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 9 deletions.
diff --git a/src/machine/asm/mod.rs b/src/machine/asm/mod.rs
@@ -134,7 +134,7 @@ fn check_memory_writable(
         let page = page + 1;
         if page as usize >= machine.memory_pages() {
             return Err(Error::MemOutOfBound(
-                addr + size as u64,
+                addr.wrapping_add(size as u64),
                 OutOfBoundKind::Memory,
             ));
         } else {
@@ -167,7 +167,7 @@ fn check_memory_executable(
         let page = page + 1;
         if page as usize >= machine.memory_pages() {
             return Err(Error::MemOutOfBound(
-                addr + size as u64,
+                addr.wrapping_add(size as u64),
                 OutOfBoundKind::Memory,
             ));
         } else {
@@ -197,7 +197,7 @@ fn check_memory_inited(
         let page = page + 1;
         if page as usize >= machine.memory_pages() {
             return Err(Error::MemOutOfBound(
-                addr + size as u64,
+                addr.wrapping_add(size as u64),
                 OutOfBoundKind::Memory,
             ));
         } else {
@@ -383,14 +383,17 @@ impl Memory for Box<AsmCoreMachine> {
             return Err(Error::MemPageUnalignedAccess(addr));
         }
         if round_page_up(size) != size {
-            return Err(Error::MemPageUnalignedAccess(addr + size));
+            return Err(Error::MemPageUnalignedAccess(addr.wrapping_add(size)));
         }
 
         if addr > self.memory_size() as u64 {
             return Err(Error::MemOutOfBound(addr, OutOfBoundKind::Memory));
         }
         if size > self.memory_size() as u64 || addr + size > self.memory_size() as u64 {
-            return Err(Error::MemOutOfBound(addr + size, OutOfBoundKind::Memory));
+            return Err(Error::MemOutOfBound(
+                addr.wrapping_add(size),
+                OutOfBoundKind::Memory,
+            ));
         }
         if offset_from_addr > size {
             return Err(Error::MemOutOfBound(

diff --git a/src/memory/wxorx.rs b/src/memory/wxorx.rs
@@ -45,14 +45,17 @@ impl<M: Memory> Memory for WXorXMemory<M> {
             return Err(Error::MemPageUnalignedAccess(addr));
         }
         if round_page_up(size) != size {
-            return Err(Error::MemPageUnalignedAccess(addr + size));
+            return Err(Error::MemPageUnalignedAccess(addr.wrapping_add(size)));
         }
 
         if addr > self.memory_size() as u64 {
             return Err(Error::MemOutOfBound(addr, OutOfBoundKind::Memory));
         }
         if size > self.memory_size() as u64 || addr + size > self.memory_size() as u64 {
-            return Err(Error::MemOutOfBound(addr + size, OutOfBoundKind::Memory));
+            return Err(Error::MemOutOfBound(
+                addr.wrapping_add(size),
+                OutOfBoundKind::Memory,
+            ));
         }
         if offset_from_addr > size {
             return Err(Error::MemOutOfBound(

diff --git a/src/snapshot2.rs b/src/snapshot2.rs
@@ -70,7 +70,9 @@ impl<I: Clone + PartialEq, D: DataSource<I>> Snapshot2Context<I, D> {
             }
             let data = self.data_source().load_data(id, *offset, *length)?;
             if data.len() as u64 % PAGE_SIZE != 0 {
-                return Err(Error::MemPageUnalignedAccess(address * data.len() as u64));
+                return Err(Error::MemPageUnalignedAccess(
+                    address.wrapping_add(data.len() as u64),
+                ));
             }
             machine.memory_mut().store_bytes(*address, &data)?;
             for i in 0..(data.len() as u64 / PAGE_SIZE) {
@@ -85,7 +87,7 @@ impl<I: Clone + PartialEq, D: DataSource<I>> Snapshot2Context<I, D> {
             }
             if content.len() as u64 % PAGE_SIZE != 0 {
                 return Err(Error::MemPageUnalignedAccess(
-                    address + content.len() as u64,
+                    address.wrapping_add(content.len() as u64),
                 ));
             }
             machine.memory_mut().store_bytes(*address, content)?;