Merge pull request #218 from chriseth/fix_overwriteMemory

Fix memory overwrite problem for arrays.
ethereum · Nov 17, 2015 · f4de369 · f4de369
2 parents 28c3f18 + 0c900f9
commit f4de369
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 3 deletions.
diff --git a/libsolidity/codegen/LValue.cpp b/libsolidity/codegen/LValue.cpp
@@ -103,10 +103,20 @@ void MemoryItem::storeValue(Type const& _sourceType, SourceLocation const&, bool
 		if (!_move)
 		{
 			utils.moveToStackTop(m_dataType->sizeOnStack());
-			utils.copyToStackTop(2, m_dataType->sizeOnStack());
+			utils.copyToStackTop(1 + m_dataType->sizeOnStack(), m_dataType->sizeOnStack());
+		}
+		if (!m_padded)
+		{
+			solAssert(m_dataType->calldataEncodedSize(false) == 1, "Invalid non-padded type.");
+			if (m_dataType->category() == Type::Category::FixedBytes)
+				m_context << u256(0) << eth::Instruction::BYTE;
+			m_context << eth::Instruction::SWAP1 << eth::Instruction::MSTORE8;
+		}
+		else
+		{
+			utils.storeInMemoryDynamic(*m_dataType, m_padded);
+			m_context << eth::Instruction::POP;
 		}
-		utils.storeInMemoryDynamic(*m_dataType, m_padded);
-		m_context << eth::Instruction::POP;
 	}
 	else
 	{

diff --git a/test/libsolidity/SolidityEndToEndTest.cpp b/test/libsolidity/SolidityEndToEndTest.cpp
@@ -5816,6 +5816,21 @@ BOOST_AUTO_TEST_CASE(lone_struct_array_type)
 	BOOST_CHECK(callContractFunction("f()") == encodeArgs(u256(3)));
 }
 
+BOOST_AUTO_TEST_CASE(memory_overwrite)
+{
+	char const* sourceCode = R"(
+		contract C {
+			function f() returns (bytes x) {
+				x = "12345";
+				x[3] = 0x61;
+				x[0] = 0x62;
+			}
+		}
+	)";
+	compileAndRun(sourceCode);
+	BOOST_CHECK(callContractFunction("f()") == encodeDyn(string("b23a5")));
+}
+
 BOOST_AUTO_TEST_SUITE_END()
 
 }