Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Gno crashes with a runtime panic if a type declaration has a selector expression but Go reports an invalid type at compile type #3712

Open
odeke-em opened this issue Feb 9, 2025 · 1 comment
Labels
🐞 bug Something isn't working non-security

Comments

@odeke-em
Copy link
Contributor

odeke-em commented Feb 9, 2025

This code found by fuzzing

package main

type A int.A0000

func main() {}

In Gno

With https://play.gno.land/p/G8-Hf2OrqDg panics at runtime without a compile failure

panic:runtime error: invalid memory address or nil pointer dereferenc [recovered]
       panic:runtime error: invalid memory address or nil pointer dereference
[signal0x code0x addr0x pc0x]

goroutine runnin]:
github.com/gnolang/gno/gnovm/pkg/gnolang.predefineNow.func)
       /home/runner/_work/studio/studio/gno/gnovm/pkg/gnolang/preprocess.g397 0x1f
pani0x11c56,0x1117e8)
       /home/runner/_work/_tool/go/1.22.4/x64/src/runtime/panic.g77 0x1a
github.com/gnolang/gno/gnovm/pkg/gnolang.tryPredefin0x4e797,0x26f5e0,0x4e816,0x27d000,0x4e3b2,0x27ca28)
       /home/runner/_work/studio/studio/gno/gnovm/pkg/gnolang/preprocess.g424 0xce
github.com/gnolang/gno/gnovm/pkg/gnolang.predefineNow0x4e797,0x26f5e0,0x4e816,0x27d000,0x4e3b2,0x27ca28,0x264d72)
       /home/runner/_work/studio/studio/gno/gnovm/pkg/gnolang/preprocess.g400 0x1e
github.com/gnolang/gno/gnovm/pkg/gnolang.predefineNo0x4e797,0x26f5e0,0x4e816,0x27d000,0x4e3b2,0x27ca28)
       /home/runner/_work/studio/studio/gno/gnovm/pkg/gnolang/preprocess.g398 0x2
github.com/gnolang/gno/gnovm/pkg/gnolang.PredefineFileSe0x4e797,0x26f5e0,0x27d030,0x240baa)
       /home/runner/_work/studio/studio/gno/gnovm/pkg/gnolang/preprocess.g7 0x9f
github.com/gnolang/gno/gnovm/pkg/gnolang.(*Machine).runFileDecl0x26e048,0x243ab4,0x,0x)
       /home/runner/_work/studio/studio/gno/gnovm/pkg/gnolang/machine.g64 0x22
github.com/gnolang/gno/gnovm/pkg/gnolang.(*Machine).RunFile0x26e048,0x243ab4,0x,0x)
       /home/runner/_work/studio/studio/gno/gnovm/pkg/gnolang/machine.g59 0x5
main.execRu0x27aac0,0x27b823,0x,0x,0x4e397,0x270b2c)
       /home/runner/_work/studio/studio/gno/gnovm/cmd/gno/run.g13 0x36
main.newRunCmd.func0x4dba7,0x11ab36,0x27b823,0x,0x)
       /home/runner/_work/studio/studio/gno/gnovm/cmd/gno/run.g3 0x2
github.com/gnolang/gno/tm2/pkg/commands.(*Command).Ru0x26d976,0x4dba7,0x11ab36)
       /home/runner/_work/studio/studio/gno/tm2/pkg/commands/command.g25 0x1a
github.com/gnolang/gno/tm2/pkg/commands.(*Command).Ru0x26d91e,0x4dba7,0x11ab36)
       /home/runner/_work/studio/studio/gno/tm2/pkg/commands/command.g25 0x13
github.com/gnolang/gno/tm2/pkg/commands.(*Command).ParseAndRu0x26d91e,0x4dba7,0x11ab36,0x242e09,0x,0x)
       /home/runner/_work/studio/studio/gno/tm2/pkg/commands/command.g14 0x4
github.com/gnolang/gno/tm2/pkg/commands.(*Command).Execut0x26d91e,0x4dba7,0x11ab36,0x242e09,0x,0x)
       /home/runner/_work/studio/studio/gno/tm2/pkg/commands/command.g11 0x2
main.mai)
       /home/runner/_work/studio/studio/gno/gnovm/cmd/gno/main.g1 0x5

In Go

Correctly fails in Go per https://go.dev/play/p/ck3LDvKbLEH with

./prog.go:5:12: int.A0000 is not a type
@odeke-em odeke-em added the 🐞 bug Something isn't working label Feb 9, 2025
@odeke-em odeke-em changed the title Gno crashes with a runtime panic if a type declaration has a selector expression but Go reports an invalid type Gno crashes with a runtime panic if a type declaration has a selector expression but Go reports an invalid type at compile type Feb 9, 2025
odeke-em added a commit to odeke-em/gno that referenced this issue Feb 9, 2025
…ions + expected failures

With this change, we enhance the fuzzer with known panic causes but
even better by looking at results from Go panicking and raising
if there is some discrepancy.

This update has helped uncover a couple of bugs like:
* gnolang#3712
* gnolang#3713
odeke-em added a commit to odeke-em/gno that referenced this issue Feb 9, 2025
…ions + expected failures

With this change, we enhance the fuzzer with known panic causes but
even better by looking at results from Go panicking and raising
if there is some discrepancy.

This update has helped uncover a couple of bugs like:
* gnolang#3712
* gnolang#3713
odeke-em added a commit to odeke-em/gno that referenced this issue Feb 9, 2025
…ions + expected failures

With this change, we enhance the fuzzer with known panic causes but
even better by looking at results from Go panicking and raising
if there is some discrepancy.

This update has helped uncover a couple of bugs like:
* gnolang#3712
* gnolang#3713
odeke-em added a commit to odeke-em/gno that referenced this issue Feb 11, 2025
…ions + expected failures

With this change, we enhance the fuzzer with known panic causes but
even better by looking at results from Go panicking and raising
if there is some discrepancy.

This update has helped uncover a couple of bugs like:
* gnolang#3712
* gnolang#3713
@kristovatlas
Copy link
Contributor

Thank you for filing this issue.

It does not appear to be an exploitable security issue, as it cannot be published to chain:

% gnokey maketx addpkg --pkgpath "gno.land/r/kristovatlas/gno3712a" --pkgdir . --gas-fee 10000000ugnot --gas-wanted 800000 --broadcast --chainid dev --remote localhost:26657 Dev
Enter password.
TX HASH:
--= Error =--
Data: invalid gno package; type check errors:
gno.land/r/kristovatlas/gno3712a/gno3712.gno:3:12: int.A0000 is not a type
Msg Traces:
    0  redacted/gno/tm2/pkg/errors/errors.go:28 - deliver transaction failed: log:msg:0,success:false,log:--= Error =--
Data: vm.TypeCheckError{abciError:vm.abciError{}, Errors:[]string{"gno.land/r/kristovatlas/gno3712a/gno3712.gno:3:12: int.A0000 is not a type"}}
Msg Traces:
Stack Trace:
...snip...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🐞 bug Something isn't working non-security
Projects
Status: Triage
Development

No branches or pull requests

2 participants