Skip to content

FunC does not respect error code 5 in left shift and right shift operators #2997

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jeshecdom opened this issue May 3, 2025 · 1 comment
Labels
activity: found-by-fuzzing Do not add! Issues found by fuzzer by previous project. misc: func-bug Bugs in FunC compiler

Comments

@jeshecdom
Copy link
Contributor

In the following contract that uses right and left shifts:

contract Test() {

    receive(){}
    
    get fun getBool1(x: Int): Bool {
        return (-1 >> x) <= 1;
    }

    get fun getBool2(x: Int): Bool {
        return (-1 << x) <= 1;
    }
}

Getters getBool1 and getBool2 will return true for any assignment of parameter x outside the interval [0..256]. However, the expected behavior is to produce error code 5 when calling such getters outside the allowed interval [0..256]. The interpreter does report an error; for example, interpreting (-1 >> x) <= 1 when x = -2 produces the error: Cannot evaluate expression to a constant: the number of bits shifted ('-2') must be within [0..256] range.

The FunC code of the above getters is:

(tuple, int) $Test$_fun_getBool1(tuple $self, int $x) impure inline_ref {
    var ($self) = $self;
    var $fresh$ret_0 = ((-1 >> $x) <= 1);
    return ($self, $fresh$ret_0);
}

(tuple, int) $Test$_fun_getBool2(tuple $self, int $x) impure inline_ref {
    var ($self) = $self;
    var $fresh$ret_1 = ((-1 << $x) <= 1);
    return ($self, $fresh$ret_1);
}

While the Fift code of the above getters is:

$Test$_fun_getBool1 PROCREF:<{
    DROP
    TRUE
}>
$Test$_fun_getBool2 PROCREF:<{
    DROP
    TRUE
}>

Notice that FunC replaced the expressions (-1 >> $x) <= 1 and (-1 << $x) <= 1 with TRUE in the Fift code.

The above means that it is not safe to rely on catching error code 5 in try/catch statements in order to execute important business logic, similar to issue #2832 for integer overflows.

@i582
Copy link
Member

i582 commented May 7, 2025

ton-blockchain/ton#1651

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
activity: found-by-fuzzing Do not add! Issues found by fuzzer by previous project. misc: func-bug Bugs in FunC compiler
Projects
None yet
Development

No branches or pull requests

3 participants