[crash/fuzzing] "IllegalArgumentException: List out of bounds" during block ssz parsing

[pventuzelo]

Description

During fuzzing with beacon-fuzz, I triggered an java.lang.IllegalArgumentException: List out of bounds during block SSZ parsing using teku transition blocks tool.

Additional info

Other eth2 clients detects this exception and returns:

• lighthouse: Ssz decode failed: OutOfBoundsByte { i: 0 }
• nim: SszSizeMismatchError

Related code:

https://github.com/PegaSysEng/teku/blob/c6e8e56b7a0edc078a88d1b40587262d22bd4c0a/ssz/src/main/java/tech/pegasys/artemis/ssz/SSZTypes/SSZArrayCollection.java#L66-L72

Steps to Reproduce (Bug)

• Download: list_out_of_bound_teku.zip

• Crash:

# install
./gradlew distTar installDist

# go to build folder
cd build/install/

# Run teku
bin/teku transition blocks --pre=list_out_of_bound_state_teku.ssz --network=mainnet list_out_of_bound_block_teku.ssz
java.lang.IllegalArgumentException: List out of bounds
	at tech.pegasys.artemis.ssz.SSZTypes.SSZArrayCollection.add(SSZArrayCollection.java:70)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeFixedElementList(SimpleOffsetSerializer.java:417)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeVariableParts(SimpleOffsetSerializer.java:329)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeContainer(SimpleOffsetSerializer.java:229)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeVariableParts(SimpleOffsetSerializer.java:348)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeContainer(SimpleOffsetSerializer.java:229)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeVariableParts(SimpleOffsetSerializer.java:348)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeContainer(SimpleOffsetSerializer.java:229)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserializeContainerErrorWrapper(SimpleOffsetSerializer.java:205)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.lambda$deserialize$1(SimpleOffsetSerializer.java:196)
	at org.apache.tuweni.ssz.SSZ.decode(SSZ.java:1255)
	at tech.pegasys.artemis.datastructures.util.SimpleOffsetSerializer.deserialize(SimpleOffsetSerializer.java:194)
	at tech.pegasys.artemis.cli.subcommand.TransitionCommand.readBlock(TransitionCommand.java:158)
	at tech.pegasys.artemis.cli.subcommand.TransitionCommand.lambda$blocks$0(TransitionCommand.java:81)
	at tech.pegasys.artemis.cli.subcommand.TransitionCommand.processStateTransition(TransitionCommand.java:131)
	at tech.pegasys.artemis.cli.subcommand.TransitionCommand.blocks(TransitionCommand.java:76)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at picocli.CommandLine.executeUserObject(CommandLine.java:1802)
	at picocli.CommandLine.access$900(CommandLine.java:145)
	at picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2150)
	at picocli.CommandLine$RunLast.handle(CommandLine.java:2144)
	at picocli.CommandLine$RunLast.handle(CommandLine.java:2108)
	at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:1975)
	at picocli.CommandLine.execute(CommandLine.java:1904)
	at tech.pegasys.artemis.cli.BeaconNodeCommand.parse(BeaconNodeCommand.java:185)
	at tech.pegasys.artemis.Artemis.main(Artemis.java:31)

Versions

• Github branch: master
• Github commit: 1cc3466
• Java version: openjdk version "11.0.7" 2020-04-14
• OS Name & Version: Ubuntu 18.04.4 LTS
• Kernel Version: 4.15.0-96-generic