Skip to content

zkVM args and env length can overflow #158016

Description

@kevin-valerio

A large byte length can overflow to zero and still be used as the slice length.

That's targeting riscv32im-risc0-zkvm-elf where the implementations of std::env::args_os() and std::env::var_os() trust the host length. The code can allocate zero words and then build a huge
slice from that pointer.

Ideally we should panic instead of overflowing to avoid any huge allocation

let nwords = (nbytes + WORD_SIZE - 1) / WORD_SIZE;
let words = unsafe { abi::sys_alloc_words(nwords) };

let arg_len_words = (arg_len + WORD_SIZE - 1) / WORD_SIZE;

Metadata

Metadata

Assignees

No one assigned

    Labels

    C-bugCategory: This is a bug.O-risc0Operating system: RISC0 zkVM https://risczero.com/needs-triageThis issue may need triage. Remove it if it has been sufficiently triaged.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions