Skip to content

fix(evm): fix use-after-free in EXTCODEHASH due to deferred pointer load #368

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zoowii merged 1 commit into from
Feb 28, 2026
+8 −10
Merged

fix(evm): fix use-after-free in EXTCODEHASH due to deferred pointer load #368

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 4 additions & 6 deletions src/compiler/evm_frontend/evm_imported.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -334,8 +334,8 @@ uint64_t evmGetExtCodeSize(zen::runtime::EVMInstance *Instance,
return Size;
}

const uint8_t *evmGetExtCodeHash(zen::runtime::EVMInstance *Instance,
const uint8_t *Address) {
const intx::uint256 *evmGetExtCodeHash(zen::runtime::EVMInstance *Instance,
const uint8_t *Address) {
const zen::runtime::EVMModule *Module = Instance->getModule();
ZEN_ASSERT(Module && Module->Host);

Expand All @@ -347,11 +347,9 @@ const uint8_t *evmGetExtCodeHash(zen::runtime::EVMInstance *Instance,
Instance->chargeGas(zen::evm::ADDITIONAL_COLD_ACCOUNT_ACCESS_COST);
}

auto &Cache = Instance->getMessageCache();
evmc::bytes32 Hash = Module->Host->get_code_hash(Addr);
Cache.ExtcodeHashes.push_back(Hash);

return Cache.ExtcodeHashes.back().bytes;
intx::uint256 HashValue = intx::be::load<intx::uint256>(Hash);
return storeUint256Result(HashValue);
Comment on lines 337 to 352
Copy link

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add a regression test that exercises EXTCODEHASH in the JIT path (e.g., multiple EXTCODEHASH results used after subsequent host calls) to ensure the previous deferred-load use-after-free cannot reappear and that the returned hash value is stable/correct across repeated calls.

Copilot uses AI. Check for mistakes.
Copy link
Contributor

@zoowii zoowii Feb 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot open a new pull request to apply changes based on this feedback

}

uint64_t evmGetCallDataSize(zen::runtime::EVMInstance *Instance) {
Expand Down
6 changes: 3 additions & 3 deletions src/compiler/evm_frontend/evm_imported.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ struct RuntimeFunctions {
VoidWithUInt64UInt64UInt64Fn SetCodeCopy;
U256Fn GetGasPrice;
SizeWithBytes32Fn GetExtCodeSize;
Bytes32WithBytes32Fn GetExtCodeHash;
U256WithBytes32Fn GetExtCodeHash;
Bytes32WithInt64Fn GetBlockHash;
Bytes32Fn GetCoinBase;
U256Fn GetTimestamp;
Expand Down Expand Up @@ -185,8 +185,8 @@ void evmSetCodeCopy(zen::runtime::EVMInstance *Instance, uint64_t DestOffset,
const intx::uint256 *evmGetGasPrice(zen::runtime::EVMInstance *Instance);
uint64_t evmGetExtCodeSize(zen::runtime::EVMInstance *Instance,
const uint8_t *Address);
const uint8_t *evmGetExtCodeHash(zen::runtime::EVMInstance *Instance,
const uint8_t *Address);
const intx::uint256 *evmGetExtCodeHash(zen::runtime::EVMInstance *Instance,
const uint8_t *Address);
const uint8_t *evmGetBlockHash(zen::runtime::EVMInstance *Instance,
int64_t BlockNumber);
const uint8_t *evmGetCoinBase(zen::runtime::EVMInstance *Instance);
Expand Down
2 changes: 1 addition & 1 deletion src/compiler/evm_frontend/evm_mir_compiler.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2549,7 +2549,7 @@ EVMMirBuilder::handleExtCodeHash(Operand Address) {
#ifdef ZEN_ENABLE_EVM_GAS_REGISTER
syncGasToMemory();
#endif
auto Result = callRuntimeFor<const uint8_t *, const uint8_t *>(
auto Result = callRuntimeFor<const intx::uint256 *, const uint8_t *>(
RuntimeFunctions.GetExtCodeHash, Address);
#ifdef ZEN_ENABLE_EVM_GAS_REGISTER
reloadGasFromMemory();
Expand Down