|
|
@ -21,6 +21,7 @@ from mythril.laser.smt import ( |
|
|
|
symbol_factory, |
|
|
|
symbol_factory, |
|
|
|
Not, |
|
|
|
Not, |
|
|
|
Expression, |
|
|
|
Expression, |
|
|
|
|
|
|
|
Bool, |
|
|
|
) |
|
|
|
) |
|
|
|
|
|
|
|
|
|
|
|
import logging |
|
|
|
import logging |
|
|
@ -33,22 +34,22 @@ class OverUnderflowAnnotation: |
|
|
|
""" Symbol Annotation used if a BitVector can overflow""" |
|
|
|
""" Symbol Annotation used if a BitVector can overflow""" |
|
|
|
|
|
|
|
|
|
|
|
def __init__( |
|
|
|
def __init__( |
|
|
|
self, overflowing_state: GlobalState, operator: str, constraints |
|
|
|
self, overflowing_state: GlobalState, operator: str, constraint: Bool |
|
|
|
) -> None: |
|
|
|
) -> None: |
|
|
|
self.overflowing_state = overflowing_state |
|
|
|
self.overflowing_state = overflowing_state |
|
|
|
self.operator = operator |
|
|
|
self.operator = operator |
|
|
|
self.constraints = constraints |
|
|
|
self.constraint = constraint |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class OverUnderflowStateAnnotation(StateAnnotation): |
|
|
|
class OverUnderflowStateAnnotation(StateAnnotation): |
|
|
|
""" State Annotation used if an overflow is both possible and used in the annotated path""" |
|
|
|
""" State Annotation used if an overflow is both possible and used in the annotated path""" |
|
|
|
|
|
|
|
|
|
|
|
def __init__( |
|
|
|
def __init__( |
|
|
|
self, overflowing_state: GlobalState, operator: str, constraints |
|
|
|
self, overflowing_state: GlobalState, operator: str, constraint: Bool |
|
|
|
) -> None: |
|
|
|
) -> None: |
|
|
|
self.overflowing_state = overflowing_state |
|
|
|
self.overflowing_state = overflowing_state |
|
|
|
self.operator = operator |
|
|
|
self.operator = operator |
|
|
|
self.constraints = constraints |
|
|
|
self.constraint = constraint |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class IntegerOverflowUnderflowModule(DetectionModule): |
|
|
|
class IntegerOverflowUnderflowModule(DetectionModule): |
|
|
@ -120,7 +121,7 @@ class IntegerOverflowUnderflowModule(DetectionModule): |
|
|
|
if model is None: |
|
|
|
if model is None: |
|
|
|
return |
|
|
|
return |
|
|
|
|
|
|
|
|
|
|
|
annotation = OverUnderflowAnnotation(state, "addition", [c]) |
|
|
|
annotation = OverUnderflowAnnotation(state, "addition", c) |
|
|
|
op0.annotate(annotation) |
|
|
|
op0.annotate(annotation) |
|
|
|
|
|
|
|
|
|
|
|
def _handle_mul(self, state): |
|
|
|
def _handle_mul(self, state): |
|
|
@ -132,7 +133,7 @@ class IntegerOverflowUnderflowModule(DetectionModule): |
|
|
|
if model is None: |
|
|
|
if model is None: |
|
|
|
return |
|
|
|
return |
|
|
|
|
|
|
|
|
|
|
|
annotation = OverUnderflowAnnotation(state, "multiplication", [c]) |
|
|
|
annotation = OverUnderflowAnnotation(state, "multiplication", c) |
|
|
|
op0.annotate(annotation) |
|
|
|
op0.annotate(annotation) |
|
|
|
|
|
|
|
|
|
|
|
def _handle_sub(self, state): |
|
|
|
def _handle_sub(self, state): |
|
|
@ -144,7 +145,7 @@ class IntegerOverflowUnderflowModule(DetectionModule): |
|
|
|
if model is None: |
|
|
|
if model is None: |
|
|
|
return |
|
|
|
return |
|
|
|
|
|
|
|
|
|
|
|
annotation = OverUnderflowAnnotation(state, "subtraction", [c]) |
|
|
|
annotation = OverUnderflowAnnotation(state, "subtraction", c) |
|
|
|
op0.annotate(annotation) |
|
|
|
op0.annotate(annotation) |
|
|
|
|
|
|
|
|
|
|
|
def _handle_exp(self, state): |
|
|
|
def _handle_exp(self, state): |
|
|
@ -154,19 +155,20 @@ class IntegerOverflowUnderflowModule(DetectionModule): |
|
|
|
op1 > symbol_factory.BitVecVal(256, 256), |
|
|
|
op1 > symbol_factory.BitVecVal(256, 256), |
|
|
|
op0 > symbol_factory.BitVecVal(1, 256), |
|
|
|
op0 > symbol_factory.BitVecVal(1, 256), |
|
|
|
) |
|
|
|
) |
|
|
|
constraints = [c1, c2] |
|
|
|
|
|
|
|
elif op1.symbolic: |
|
|
|
elif op1.symbolic: |
|
|
|
c1 = op1 >= symbol_factory.BitVecVal(ceil(256 / log2(op0.value)), 256) |
|
|
|
constraint = op1 >= symbol_factory.BitVecVal( |
|
|
|
constraints = [c1] |
|
|
|
ceil(256 / log2(op0.value)), 256 |
|
|
|
|
|
|
|
) |
|
|
|
elif op0.symbolic: |
|
|
|
elif op0.symbolic: |
|
|
|
c1 = op0 >= symbol_factory.BitVecVal(2 ** ceil(256 / op1.value), 256) |
|
|
|
constraint = op0 >= symbol_factory.BitVecVal( |
|
|
|
constraints = [c1] |
|
|
|
2 ** ceil(256 / op1.value), 256 |
|
|
|
|
|
|
|
) |
|
|
|
else: |
|
|
|
else: |
|
|
|
constraints = [op0.value ** op1.value >= 2 ** 256] |
|
|
|
constraint = op0.value ** op1.value >= 2 ** 256 |
|
|
|
model = self._try_constraints(state.node.constraints, constraints) |
|
|
|
model = self._try_constraints(state.node.constraints, [constraint]) |
|
|
|
if model is None: |
|
|
|
if model is None: |
|
|
|
return |
|
|
|
return |
|
|
|
annotation = OverUnderflowAnnotation(state, "exponentiation", constraints) |
|
|
|
annotation = OverUnderflowAnnotation(state, "exponentiation", constraint) |
|
|
|
op0.annotate(annotation) |
|
|
|
op0.annotate(annotation) |
|
|
|
|
|
|
|
|
|
|
|
@staticmethod |
|
|
|
@staticmethod |
|
|
@ -213,7 +215,7 @@ class IntegerOverflowUnderflowModule(DetectionModule): |
|
|
|
OverUnderflowStateAnnotation( |
|
|
|
OverUnderflowStateAnnotation( |
|
|
|
annotation.overflowing_state, |
|
|
|
annotation.overflowing_state, |
|
|
|
annotation.operator, |
|
|
|
annotation.operator, |
|
|
|
annotation.constraints, |
|
|
|
annotation.constraint, |
|
|
|
) |
|
|
|
) |
|
|
|
) |
|
|
|
) |
|
|
|
|
|
|
|
|
|
|
@ -229,7 +231,7 @@ class IntegerOverflowUnderflowModule(DetectionModule): |
|
|
|
OverUnderflowStateAnnotation( |
|
|
|
OverUnderflowStateAnnotation( |
|
|
|
annotation.overflowing_state, |
|
|
|
annotation.overflowing_state, |
|
|
|
annotation.operator, |
|
|
|
annotation.operator, |
|
|
|
annotation.constraints, |
|
|
|
annotation.constraint, |
|
|
|
) |
|
|
|
) |
|
|
|
) |
|
|
|
) |
|
|
|
|
|
|
|
|
|
|
@ -271,7 +273,7 @@ class IntegerOverflowUnderflowModule(DetectionModule): |
|
|
|
try: |
|
|
|
try: |
|
|
|
|
|
|
|
|
|
|
|
transaction_sequence = solver.get_transaction_sequence( |
|
|
|
transaction_sequence = solver.get_transaction_sequence( |
|
|
|
state, node.constraints + annotation.constraints |
|
|
|
state, node.constraints + [annotation.constraint] |
|
|
|
) |
|
|
|
) |
|
|
|
|
|
|
|
|
|
|
|
issue.debug = json.dumps(transaction_sequence, indent=4) |
|
|
|
issue.debug = json.dumps(transaction_sequence, indent=4) |
|
|
|