1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

use crate::{verify_env::TxVerifyEnv, ScriptError};
use byteorder::{ByteOrder, LittleEndian};
use ckb_chain_spec::consensus::Consensus;
use ckb_types::core::TransactionView;
use ckb_vm::{
    instructions::{extract_opcode, i, m, rvc, Instruction, Itype},
    machine::VERSION0,
    registers::ZERO,
};
use ckb_vm_definitions::instructions as insts;
use goblin::elf::{section_header::SHF_EXECINSTR, Elf};

#[cfg(test)]
mod tests;

pub(crate) const CKB_VM_ISSUE_92: &str = "https://github.com/nervosnetwork/ckb-vm/issues/92";

/// Ill formed transactions checker.
pub struct IllTransactionChecker<'a> {
    tx: &'a TransactionView,
    consensus: &'a Consensus,
    tx_env: &'a TxVerifyEnv,
}

impl<'a> IllTransactionChecker<'a> {
    /// Creates the checker for a transaction.
    pub fn new(tx: &'a TransactionView, consensus: &'a Consensus, tx_env: &'a TxVerifyEnv) -> Self {
        IllTransactionChecker {
            tx,
            consensus,
            tx_env,
        }
    }

    /// Checks whether the transaction is ill formed.
    pub fn check(&self) -> Result<(), ScriptError> {
        let epoch_number = self.tx_env.epoch_number_without_proposal_window();
        let hardfork_switch = self.consensus.hardfork_switch();
        // Assume that after ckb2021 is activated, developers will only upload code for vm v1.
        if !hardfork_switch.is_vm_version_1_and_syscalls_2_enabled(epoch_number) {
            // IllTransactionChecker is only for vm v0
            for (i, data) in self.tx.outputs_data().into_iter().enumerate() {
                IllScriptChecker::new(&data.raw_data(), i).check()?;
            }
        }
        Ok(())
    }
}

struct IllScriptChecker<'a> {
    data: &'a [u8],
    index: usize,
}

impl<'a> IllScriptChecker<'a> {
    pub fn new(data: &'a [u8], index: usize) -> Self {
        IllScriptChecker { data, index }
    }

    pub fn check(&self) -> Result<(), ScriptError> {
        if self.data.is_empty() {
            return Ok(());
        }
        let elf = match Elf::parse(self.data) {
            Ok(elf) => elf,
            // If the data cannot be parsed as ELF format, we will treat
            // it as a non-script binary data. The checking will be skipped
            // here.
            Err(_) => return Ok(()),
        };
        for section_header in elf.section_headers {
            if section_header.sh_flags & u64::from(SHF_EXECINSTR) != 0 {
                let mut pc = section_header.sh_offset;
                let end = section_header.sh_offset + section_header.sh_size;
                while pc < end {
                    let (option_instruction, len) = self.decode_instruction(pc);
                    if let Some(i) = option_instruction {
                        if extract_opcode(i) == insts::OP_JALR {
                            let i = Itype(i);
                            if i.rs1() == i.rd() && i.rd() != ZERO {
                                return Err(ScriptError::EncounteredKnownBugs(
                                    CKB_VM_ISSUE_92.to_string(),
                                    self.index,
                                ));
                            }
                        };
                    }
                    pc += len;
                }
            }
        }
        Ok(())
    }

    fn decode_instruction(&self, pc: u64) -> (Option<Instruction>, u64) {
        if pc + 2 > self.data.len() as u64 {
            return (None, 2);
        }
        let mut i = u32::from(LittleEndian::read_u16(&self.data[pc as usize..]));
        let len = if i & 0x3 == 0x3 { 4 } else { 2 };
        if len == 4 {
            if pc + 4 > self.data.len() as u64 {
                return (None, 4);
            }
            i = LittleEndian::read_u32(&self.data[pc as usize..]);
        }
        let factories = [rvc::factory::<u64>, i::factory::<u64>, m::factory::<u64>];
        for factory in &factories {
            if let Some(instruction) = factory(i, VERSION0) {
                return (Some(instruction), len);
            }
        }
        (None, len)
    }
}