-
-
Notifications
You must be signed in to change notification settings - Fork 15k
zkVM args and env length can overflow #158016
Copy link
Copy link
Open
Labels
C-bugCategory: This is a bug.Category: This is a bug.O-risc0Operating system: RISC0 zkVM https://risczero.com/Operating system: RISC0 zkVM https://risczero.com/needs-triageThis issue may need triage. Remove it if it has been sufficiently triaged.This issue may need triage. Remove it if it has been sufficiently triaged.
Description
Metadata
Metadata
Assignees
Labels
C-bugCategory: This is a bug.Category: This is a bug.O-risc0Operating system: RISC0 zkVM https://risczero.com/Operating system: RISC0 zkVM https://risczero.com/needs-triageThis issue may need triage. Remove it if it has been sufficiently triaged.This issue may need triage. Remove it if it has been sufficiently triaged.
Type
Fields
Give feedbackNo fields configured for issues without a type.
A large byte length can overflow to zero and still be used as the slice length.
That's targeting
riscv32im-risc0-zkvm-elfwhere the implementations ofstd::env::args_os()andstd::env::var_os()trust the host length. The code can allocate zero words and then build a hugeslice from that pointer.
Ideally we should panic instead of overflowing to avoid any huge allocation
rust/library/std/src/sys/env/zkvm.rs
Lines 18 to 19 in 98594f4
rust/library/std/src/sys/args/zkvm.rs
Line 19 in 98594f4