`test_callf_sneaky_stack_overflow()`¶

Documentation for tests/osaka/eip7692_eof_v1/eip4750_functions/test_callf_execution.py::test_callf_sneaky_stack_overflow@bc691d13.

Generate fixtures for these test cases for Osaka with:

fill -v tests/osaka/eip7692_eof_v1/eip4750_functions/test_callf_execution.py::test_callf_sneaky_stack_overflow --fork Osaka

CALLF where a normal execution would not overflow, but EIP-4750 CALLF rule #3 triggers.

Code Section 0 - Mostly fills the stack Code Section 1 - jumper to 2, so container verification passes (we want a runtime failure) Code Section 2 - Could require too much stack, but doesn't as it JUMPFs to 3 Code Section 3 - Writes canary values

The intent is to catch implementations of CALLF that don't enforce rule #3

Source code in tests/osaka/eip7692_eof_v1/eip4750_functions/test_callf_execution.py

@pytest.mark.parametrize(
    ("stack_height", "failure"),
    (
        pytest.param(1020, False, id="no_overflow"),
        pytest.param(1021, True, id="with_overflow"),
    ),
)
def test_callf_sneaky_stack_overflow(
    stack_height: int,
    failure: bool,
    state_test: StateTestFiller,
    pre: Alloc,
):
    """
    CALLF where a normal execution would not overflow, but EIP-4750 CALLF rule #3 triggers.

    Code Section 0 - Mostly fills the stack
    Code Section 1 - jumper to 2, so container verification passes (we want a runtime failure)
    Code Section 2 - Could require too much stack, but doesn't as it JUMPFs to 3
    Code Section 3 - Writes canary values

    The intent is to catch implementations of CALLF that don't enforce rule #3
    """
    env = Environment()
    sender = pre.fund_eoa()
    inputs = 1
    outputs = 3
    contract_address = pre.deploy_contract(
        code=Container(
            sections=[
                Section.Code(
                    code=Op.PUSH0 * stack_height
                    + Op.CALLF[1]
                    + Op.POP * stack_height
                    + Op.SSTORE(slot_code_worked, value_code_worked)
                    + Op.RETURN(0, 0),
                    max_stack_increase=stack_height + outputs - inputs,
                ),
                Section.Code(
                    Op.CALLF[2] + Op.POP + Op.RETF,
                    code_inputs=inputs,
                    code_outputs=outputs,
                    max_stack_increase=outputs - inputs + 1,
                ),
                Section.Code(
                    Op.RJUMPI[4]
                    + Op.PUSH0
                    + Op.JUMPF[3]
                    + Op.PUSH0 * (outputs - inputs + 3)
                    + Op.POP
                    + Op.RETF,
                    code_inputs=inputs,
                    code_outputs=outputs + 1,
                    max_stack_increase=outputs - inputs + 2,
                ),
                Section.Code(
                    Op.POP * inputs
                    + Op.SSTORE(slot_stack_canary, value_canary_written)
                    + Op.PUSH0 * (outputs + 1)
                    + Op.RETF,
                    code_inputs=inputs,
                    code_outputs=outputs + 1,
                    max_stack_increase=outputs - inputs + 1,
                ),
            ],
        ),
        storage={
            slot_code_worked: (
                value_canary_should_not_change if failure else value_canary_to_be_overwritten
            ),
            slot_stack_canary: (
                value_canary_should_not_change if failure else value_canary_to_be_overwritten
            ),
        },
    )

    post = {
        contract_address: Account(
            storage={
                slot_code_worked: (
                    value_canary_should_not_change if failure else value_code_worked
                ),
                slot_stack_canary: (
                    value_canary_should_not_change if failure else value_canary_written
                ),
            }
        )
    }

    tx = Transaction(
        to=contract_address,
        gas_limit=10_000_000,
        sender=sender,
    )
    state_test(env=env, pre=pre, post=post, tx=tx)

Parametrized Test Cases¶

The interactive table below is also available as a standalone page.

Test ID (Abbreviated)	stack_height	failure
...fork_Osaka-state_test-no_overflow	1020	False
...fork_Osaka-state_test-with_overflow	1021	True
...fork_Osaka-blockchain_test_from_state_test-no_overflow	1020	False
...fork_Osaka-blockchain_test_from_state_test-with_overflow	1021	True

test_callf_sneaky_stack_overflow()¶

Parametrized Test Cases¶

`test_callf_sneaky_stack_overflow()`¶