AssemblyItem AssemblyItem::toSubAssemblyTag assumes size_t is at least 64b
- Dominant language
- C++
- Stars
- 25.7k
- Forks
- 6.2k
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 29
Description
As per C++ standard, `The bit width of std::size_t is not less than 16` and `std::size_t is the unsigned integer type of the result of the following operators: sizeof`. On WASM, supported by solc, this is 32b.
But we have:
```c++
AssemblyItem AssemblyItem::toSubAssemblyTag(SubAssemblyID _subId) const
{
assertThrow(data() < (u256(1) << 64), util::Exception, "Tag already has subassembly set.");
assertThrow(m_type == PushTag || m_type == Tag, util::Exception, "");
auto tag = static_cast(u256(data()) & 0xffffffffffffffffULL);
```
Where that static_cast is wrong, and `tag` will be set incorrectly, potentially, since `0xffffffffffffffffULL` is 64b mask, but the result is cut into a 32b datatype.
Contributor guide
Research direction
Start by locating AssemblyItem::toSubAssemblyTag and inspect how the mask is converted to size_t. Reproduce or add coverage for the conversion on WASM, where size_t is 32-bit; done means the subassembly tag is not incorrectly truncated while the existing assertions remain valid.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, solidity, wasm
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100