v2.6.2 beta (#11007)

* [trace] check mem diff within range (#11002)

* Update version (v2.6.2-beta)

* bump spin to 0.5.2 (#10996)

patch vulnerability rustsec/advisory-db#132

Author: s3krit

Cargo.lock

@@ -2,7 +2,7 @@
 description = "Parity Ethereum client"
 name = "parity-ethereum"
 # NOTE Make sure to update util/version/Cargo.toml as well
-version = "2.6.1"
+version = "2.6.2"
 license = "GPL-3.0"
 authors = ["Parity Technologies <admin@parity.io>"]
 

Cargo.toml

@@ -18,6 +18,7 @@
 
 use ethereum_types::{U256, Address};
 use vm::{Error as VmError, ActionParams};
+use log::{debug, warn};
 use trace::trace::{Call, Create, Action, Res, CreateResult, CallResult, VMTrace, VMOperation, VMExecutedOperation, MemoryDiff, StorageDiff, Suicide, Reward, RewardType};
 use trace::{Tracer, VMTracer, FlatTrace};
 
@@ -245,7 +246,19 @@ impl VMTracer for ExecutiveVMTracer {
 	}
 
 	fn trace_executed(&mut self, gas_used: U256, stack_push: &[U256], mem: &[u8]) {
-		let mem_diff = self.last_mem_written.take().map(|(o, s)| (o, &(mem[o..o+s])));
+		let mem_diff = self.last_mem_written.take().map(|(o, s)| {
+			if o + s > mem.len() {
+				warn!(
+					target: "trace",
+					"Last mem written is out of bounds {} (mem is {})",
+					o + s,
+					mem.len(),
+				);
+				(o, &[][..])
+			} else {
+				(o, &(mem[o..o+s]))
+			}
+		});
 		let store_diff = self.last_store_written.take();
 		Self::with_trace_in_depth(&mut self.data, self.depth, move |trace| {
 			let ex = VMExecutedOperation {

ethcore/src/trace/executive_tracer.rs

@@ -3,7 +3,7 @@
 [package]
 name = "parity-version"
 # NOTE: this value is used for Parity Ethereum version string (via env CARGO_PKG_VERSION)
-version = "2.6.1"
+version = "2.6.2"
 authors = ["Parity Technologies <admin@parity.io>"]
 build = "build.rs"