argotorg / argotorg/solidity

Long enough string in comment causes solc to segfault

Open
#16,197 1 comment 0 reactions 0 assignees View on GitHub
bug :bug:
Dominant language
C++
Stars
25.7k
Forks
6.2k
Avg merge
2d 19h
Merged PRs (30d)
29

Description

**Description**

Any contract file containing just:

// SPDX-License-Identifier:aaa...

with enough characters (exact char does not seem to matter at all) produces (with increasing probability after about 26168 'a' characters) a segfault on occasion. The segfaults become very consistent at higher counts, but around the 26168 barrier are only occasional, so memory layout is unsurprisingly involved.

Just do

```solc ```

to induce crash.

Probably a very boring and low-impact buffer overflow, but might be worth seeing what's wrong in the parser.

On master, using AFL fuzzing. Another discovery using https://github.com/agroce/afl-compiler-fuzzer.

**Environment**
Compiler version: 0.8.31-develop.2025.8.16+commit.c79f2ccd.Linux.g++
Target EVM version (as per compiler settings): N/A
Framework/IDE (e.g. Truffle or Remix): N/A
EVM execution environment / backend / blockchain client: N/A
Operating system: Ubuntu 24.04 in docker
**Steps to Reproduce**
Above shows pretty clearly, I think.

Contributor guide

Open the contributing guide

Research direction

Start with the solc command and the minimal Solidity contract containing a long SPDX comment described in the issue. Reproduce the intermittent segfault around 26,168 characters, then inspect the compiler/parser under a debugger or fuzzing setup. Done means the input no longer crashes solc.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, solidity
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.