vm: bugfixes

crypto/test/fift/test-stack-copy.fif

@@ -0,0 +1,20 @@
+#!/usr/bin/fift -s
+"Asm.fif" include
+2500 =: N
+{ 5 * } : *K
+N 100 / =: N/100
+N 10 / =: N/10
+{ { EXECUTE } 100 times } : 100EXECUTE
+{ DUP { 2DUP } 7 times } : 15DUP
+{ { 2DUP } 50 times } : 100DUP
+{ { 15 -1 SETCONTARGS 15DUP } 10 times } : 10SET&DUP
+<{
+  CONT:<{ }>
+  15DUP
+  N/10 INT REPEAT:<{ 10SET&DUP }>
+  N/100 *K INT REPEAT:<{ 100DUP }>
+  N/100 *K INT REPEAT:<{ 100EXECUTE }>
+}>s =: Code
+
+Code csr.
+Code 1000000 gasrunvmcode

crypto/test/fift/testcc.fif

@@ -0,0 +1,32 @@
+#!/usr/bin/create-state -s
+{ dup tlb-type-lookup { nip } { "unknown TLB type " swap $+ abort } cond } : $>tlb
+{ bl word $>tlb 1 'nop } ::_ tlb:
+{ dup null? { drop true } {
+  <b true 1 i, swap ref, b> <s ExtraCurrencyCollection
+  tlb-validate-skip { empty? } { false } cond
+  } cond
+} : cc-valid?
+{ cc-valid? { ."(valid)" } { ."(invalid)" } cond } : .cc-valid
+{ { dup .cc space .cc-valid } { ."<error>" } cond cr } : cshow
+{ ."X = " over dup .cc space .cc-valid cr
+  ."Y = " dup dup .cc space .cc-valid cr
+  ."X + Y = " 2dup CC+? cshow
+  ."X - Y = " 2dup CC-? cshow
+  ."Y - X = " 2dup swap CC-? cshow
+  ."X + X = " over dup CC+? cshow
+  ."Y + Y = " dup dup CC+? cshow
+  ."X - X = " over dup CC-? cshow
+  ."Y - Y = " dup dup CC-? cshow
+  2drop ."********************" cr
+} : one-test
+CX{666666666666*$239+1000000000000*$-17} =: X
+X CX{666666666666*$239+4444*$-17} one-test
+X CX{666666666665*$239+4444*$-17} one-test
+X CX{666666666667*$239+4444*$-17} one-test
+X CX{666666666666*$239} one-test
+X CX{666666666665*$239} one-test
+X CX{666666666667*$239} one-test
+X CX{1111*$1} one-test
+X CX{0*$-17} one-test
+X cc0 1 0 +newccpair one-test
+X cc0 239 0 +newccpair one-test

crypto/test/test-db.cpp

@@ -14,7 +14,7 @@
     You should have received a copy of the GNU Lesser General Public License
     along with TON Blockchain Library.  If not, see <http://www.gnu.org/licenses/>.
 
-    Copyright 2017-2019 Telegram Systems LLP
+    Copyright 2017-2020 Telegram Systems LLP
 */
 #include "vm/boc.h"
 #include "vm/cellslice.h"
@@ -694,6 +694,32 @@ TEST(TonDb, BenchCellBuilder3) {
   td::bench(BenchCellBuilder3());
 }
 
+TEST(TonDb, BocFuzz) {
+  vm::std_boc_deserialize(td::base64_decode("te6ccgEBAQEAAgAoAAA=").move_as_ok()).ensure_error();
+  vm::std_boc_deserialize(td::base64_decode("te6ccgQBQQdQAAAAAAEAte6ccgQBB1BBAAAAAAEAAAAAAP/"
+                                            "wAACJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJicmJiYmJiYmJiYmJiQ0NDQ0NDQ0NDQ0NDQ0ND"
+                                            "Q0NiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiQAA//AAAO4=")
+                              .move_as_ok());
+  vm::std_boc_deserialize(td::base64_decode("SEkh/w==").move_as_ok()).ensure_error();
+  vm::std_boc_deserialize(
+      td::base64_decode(
+          "te6ccqwBMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMAKCEAAAAgAQ==")
+          .move_as_ok())
+      .ensure_error();
+}
+void test_parse_prefix(td::Slice boc) {
+  for (size_t i = 0; i <= boc.size(); i++) {
+    auto prefix = boc.substr(0, i);
+    vm::BagOfCells::Info info;
+    auto res = info.parse_serialized_header(prefix);
+    if (res > 0) {
+      break;
+    }
+    CHECK(res != 0);
+    CHECK(-res > (int)i);
+  }
+}
+
 TEST(TonDb, Boc) {
   td::Random::Xorshift128plus rnd{123};
   for (int t = 0; t < 1000; t++) {
@@ -704,6 +730,8 @@ TEST(TonDb, Boc) {
     auto serialized = serialize_boc(std::move(cell), mode);
     CHECK(serialized.size() != 0);
 
+    test_parse_prefix(serialized);
+
     auto loaded_cell = deserialize_boc(serialized);
     ASSERT_EQ(cell_hash, loaded_cell->get_hash());
 

crypto/test/vm.cpp

@@ -22,6 +22,7 @@
 #include "fift/utils.h"
 #include "common/bigint.hpp"
 
+#include "td/utils/base64.h"
 #include "td/utils/tests.h"
 #include "td/utils/ScopeGuard.h"
 #include "td/utils/StringBuilder.h"
@@ -53,7 +54,10 @@ std::string run_vm(td::Ref<vm::Cell> cell) {
 
   vm::Stack stack;
   try {
-    vm::run_vm_code(vm::load_cell_slice_ref(cell), stack, 0 /*flags*/, nullptr /*data*/, std::move(log) /*VmLog*/);
+    vm::GasLimits gas_limit(1000, 1000);
+
+    vm::run_vm_code(vm::load_cell_slice_ref(cell), stack, 0 /*flags*/, nullptr /*data*/, std::move(log) /*VmLog*/,
+                    nullptr, &gas_limit);
   } catch (...) {
     LOG(FATAL) << "catch unhandled exception";
   }
@@ -77,6 +81,14 @@ void test_run_vm(td::Slice code_hex) {
   test_run_vm(to_cell(buff, bits));
 }
 
+void test_run_vm_raw(td::Slice code64) {
+  auto code = td::base64_decode(code64).move_as_ok();
+  if (code.size() > 127) {
+    code.resize(127);
+  }
+  test_run_vm(vm::CellBuilder().store_bytes(code).finalize());
+}
+
 TEST(VM, simple) {
   test_run_vm("ABCBABABABA");
 }
@@ -126,12 +138,12 @@ TEST(VM, unhandled_exception_1) {
 
 TEST(VM, unhandled_exception_2) {
   // infinite loop now
-  // test_run_vm("EBEDB4");
+  test_run_vm("EBEDB4");
 }
 
 TEST(VM, unhandled_exception_3) {
   // infinite loop now
-  // test_run_vm("EBEDC0");
+  test_run_vm("EBEDC0");
 }
 
 TEST(VM, unhandled_exception_4) {
@@ -142,6 +154,13 @@ TEST(VM, unhandled_exception_5) {
   test_run_vm("738B04016D21F41476A721F49F");
 }
 
+TEST(VM, infinity_loop_1) {
+  test_run_vm_raw("f3r4AJGQ6rDraIQ=");
+}
+TEST(VM, infinity_loop_2) {
+  test_run_vm_raw("kpTt7ZLrig==");
+}
+
 TEST(VM, bigint) {
   td::StringBuilder sb({}, true);