Long enough string in comment causes solc to segfault
- Dominant language
- C++
- Stars
- 25.7k
- Forks
- 6.2k
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 29
Description
**Description**
Any contract file containing just:
// SPDX-License-Identifier:aaa...
with enough characters (exact char does not seem to matter at all) produces (with increasing probability after about 26168 'a' characters) a segfault on occasion. The segfaults become very consistent at higher counts, but around the 26168 barrier are only occasional, so memory layout is unsurprisingly involved.
Just do
```solc ```
to induce crash.
Probably a very boring and low-impact buffer overflow, but might be worth seeing what's wrong in the parser.
On master, using AFL fuzzing. Another discovery using https://github.com/agroce/afl-compiler-fuzzer.
**Environment**
Compiler version: 0.8.31-develop.2025.8.16+commit.c79f2ccd.Linux.g++
Target EVM version (as per compiler settings): N/A
Framework/IDE (e.g. Truffle or Remix): N/A
EVM execution environment / backend / blockchain client: N/A
Operating system: Ubuntu 24.04 in docker
**Steps to Reproduce**
Above shows pretty clearly, I think.
Contributor guide
Research direction
Start with the solc command and the minimal Solidity contract containing a long SPDX comment described in the issue. Reproduce the intermittent segfault around 26,168 characters, then inspect the compiler/parser under a debugger or fuzzing setup. Done means the input no longer crashes solc.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, solidity
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100