mask values to be within 32 bits

Uniswap · Sep 4, 2024 · 5eba3fb · 5eba3fb
1 parent e8cd67f
commit 5eba3fb
Show file tree

Hide file tree

Showing 64 changed files with 74 additions and 68 deletions.
diff --git a/.forge-snapshots/BaseActionsRouter_mock10commands.snap b/.forge-snapshots/BaseActionsRouter_mock10commands.snap
@@ -1 +1 @@
-62049
+62100
diff --git a/.forge-snapshots/Payments_swap_settleFromCaller_takeAllToMsgSender.snap b/.forge-snapshots/Payments_swap_settleFromCaller_takeAllToMsgSender.snap
@@ -1 +1 @@
-133506
+133557
diff --git a/.forge-snapshots/Payments_swap_settleFromCaller_takeAllToSpecifiedAddress.snap b/.forge-snapshots/Payments_swap_settleFromCaller_takeAllToSpecifiedAddress.snap
@@ -1 +1 @@
-135542
+135593
diff --git a/.forge-snapshots/Payments_swap_settleWithBalance_takeAllToMsgSender.snap b/.forge-snapshots/Payments_swap_settleWithBalance_takeAllToMsgSender.snap
@@ -1 +1 @@
-128016
+128067
diff --git a/.forge-snapshots/Payments_swap_settleWithBalance_takeAllToSpecifiedAddress.snap b/.forge-snapshots/Payments_swap_settleWithBalance_takeAllToSpecifiedAddress.snap
@@ -1 +1 @@
-128154
+128205
diff --git a/.forge-snapshots/PositionManager_burn_empty.snap b/.forge-snapshots/PositionManager_burn_empty.snap
@@ -1 +1 @@
-47468
+47509
diff --git a/.forge-snapshots/PositionManager_burn_empty_native.snap b/.forge-snapshots/PositionManager_burn_empty_native.snap
@@ -1 +1 @@
-47286
+47327
diff --git a/.forge-snapshots/PositionManager_burn_nonEmpty_native_withClose.snap b/.forge-snapshots/PositionManager_burn_nonEmpty_native_withClose.snap
@@ -1 +1 @@
-124115
+124156
diff --git a/.forge-snapshots/PositionManager_burn_nonEmpty_native_withTakePair.snap b/.forge-snapshots/PositionManager_burn_nonEmpty_native_withTakePair.snap
@@ -1 +1 @@
-123612
+123653
diff --git a/.forge-snapshots/PositionManager_burn_nonEmpty_withClose.snap b/.forge-snapshots/PositionManager_burn_nonEmpty_withClose.snap
@@ -1 +1 @@
-131193
+131234
diff --git a/.forge-snapshots/PositionManager_burn_nonEmpty_withTakePair.snap b/.forge-snapshots/PositionManager_burn_nonEmpty_withTakePair.snap
@@ -1 +1 @@
-130691
+130732
diff --git a/.forge-snapshots/PositionManager_collect_native.snap b/.forge-snapshots/PositionManager_collect_native.snap
@@ -1 +1 @@
-142671
+142722
diff --git a/.forge-snapshots/PositionManager_collect_sameRange.snap b/.forge-snapshots/PositionManager_collect_sameRange.snap
@@ -1 +1 @@
-151519
+151570
diff --git a/.forge-snapshots/PositionManager_collect_withClose.snap b/.forge-snapshots/PositionManager_collect_withClose.snap
@@ -1 +1 @@
-151519
+151570
diff --git a/.forge-snapshots/PositionManager_collect_withTakePair.snap b/.forge-snapshots/PositionManager_collect_withTakePair.snap
@@ -1 +1 @@
-150879
+150930
diff --git a/.forge-snapshots/PositionManager_decreaseLiquidity_native.snap b/.forge-snapshots/PositionManager_decreaseLiquidity_native.snap
@@ -1 +1 @@
-109612
+109652
diff --git a/.forge-snapshots/PositionManager_decreaseLiquidity_withClose.snap b/.forge-snapshots/PositionManager_decreaseLiquidity_withClose.snap
@@ -1 +1 @@
-117062
+117113
diff --git a/.forge-snapshots/PositionManager_decreaseLiquidity_withTakePair.snap b/.forge-snapshots/PositionManager_decreaseLiquidity_withTakePair.snap
@@ -1 +1 @@
-116422
+116473
diff --git a/.forge-snapshots/PositionManager_decrease_burnEmpty.snap b/.forge-snapshots/PositionManager_decrease_burnEmpty.snap
@@ -1 +1 @@
-135220
+135261
diff --git a/.forge-snapshots/PositionManager_decrease_burnEmpty_native.snap b/.forge-snapshots/PositionManager_decrease_burnEmpty_native.snap
@@ -1 +1 @@
-127960
+128000
diff --git a/.forge-snapshots/PositionManager_decrease_sameRange_allLiquidity.snap b/.forge-snapshots/PositionManager_decrease_sameRange_allLiquidity.snap
@@ -1 +1 @@
-129778
+129829
diff --git a/.forge-snapshots/PositionManager_decrease_take_take.snap b/.forge-snapshots/PositionManager_decrease_take_take.snap
@@ -1 +1 @@
-117595
+117646
diff --git a/.forge-snapshots/PositionManager_increaseLiquidity_erc20_withClose.snap b/.forge-snapshots/PositionManager_increaseLiquidity_erc20_withClose.snap
@@ -1 +1 @@
-155744
+155795
diff --git a/.forge-snapshots/PositionManager_increaseLiquidity_erc20_withSettlePair.snap b/.forge-snapshots/PositionManager_increaseLiquidity_erc20_withSettlePair.snap
@@ -1 +1 @@
-154746
+154797
diff --git a/.forge-snapshots/PositionManager_increaseLiquidity_native.snap b/.forge-snapshots/PositionManager_increaseLiquidity_native.snap
@@ -1 +1 @@
-137544
+137595
diff --git a/.forge-snapshots/PositionManager_increase_autocompoundExactUnclaimedFees.snap b/.forge-snapshots/PositionManager_increase_autocompoundExactUnclaimedFees.snap
@@ -1 +1 @@
-133889
+133940
diff --git a/.forge-snapshots/PositionManager_increase_autocompoundExcessFeesCredit.snap b/.forge-snapshots/PositionManager_increase_autocompoundExcessFeesCredit.snap
@@ -1 +1 @@
-174805
+174856
diff --git a/.forge-snapshots/PositionManager_increase_autocompound_clearExcess.snap b/.forge-snapshots/PositionManager_increase_autocompound_clearExcess.snap
@@ -1 +1 @@
-144761
+144812
diff --git a/.forge-snapshots/PositionManager_mint_native.snap b/.forge-snapshots/PositionManager_mint_native.snap
@@ -1 +1 @@
-341266
+341317
diff --git a/.forge-snapshots/PositionManager_mint_nativeWithSweep_withClose.snap b/.forge-snapshots/PositionManager_mint_nativeWithSweep_withClose.snap
@@ -1 +1 @@
-349758
+349809
diff --git a/.forge-snapshots/PositionManager_mint_nativeWithSweep_withSettlePair.snap b/.forge-snapshots/PositionManager_mint_nativeWithSweep_withSettlePair.snap
@@ -1 +1 @@
-349060
+349111
diff --git a/.forge-snapshots/PositionManager_mint_onSameTickLower.snap b/.forge-snapshots/PositionManager_mint_onSameTickLower.snap
@@ -1 +1 @@
-319248
+319299
diff --git a/.forge-snapshots/PositionManager_mint_onSameTickUpper.snap b/.forge-snapshots/PositionManager_mint_onSameTickUpper.snap
@@ -1 +1 @@
-319890
+319941
diff --git a/.forge-snapshots/PositionManager_mint_sameRange.snap b/.forge-snapshots/PositionManager_mint_sameRange.snap
@@ -1 +1 @@
-245472
+245523
diff --git a/.forge-snapshots/PositionManager_mint_settleWithBalance_sweep.snap b/.forge-snapshots/PositionManager_mint_settleWithBalance_sweep.snap
@@ -1 +1 @@
-375290
+375341
diff --git a/.forge-snapshots/PositionManager_mint_warmedPool_differentRange.snap b/.forge-snapshots/PositionManager_mint_warmedPool_differentRange.snap
@@ -1 +1 @@
-325266
+325317
diff --git a/.forge-snapshots/PositionManager_mint_withClose.snap b/.forge-snapshots/PositionManager_mint_withClose.snap
@@ -1 +1 @@
-376566
+376617
diff --git a/.forge-snapshots/PositionManager_mint_withSettlePair.snap b/.forge-snapshots/PositionManager_mint_withSettlePair.snap
@@ -1 +1 @@
-375706
+375757
diff --git a/.forge-snapshots/PositionManager_multicall_initialize_mint.snap b/.forge-snapshots/PositionManager_multicall_initialize_mint.snap
@@ -1 +1 @@
-420993
+421044
diff --git a/.forge-snapshots/V4Router_Bytecode.snap b/.forge-snapshots/V4Router_Bytecode.snap
@@ -1 +1 @@
-8773
+8798
diff --git a/.forge-snapshots/V4Router_ExactIn1Hop_nativeIn.snap b/.forge-snapshots/V4Router_ExactIn1Hop_nativeIn.snap
@@ -1 +1 @@
-119801
+119852
diff --git a/.forge-snapshots/V4Router_ExactIn1Hop_nativeOut.snap b/.forge-snapshots/V4Router_ExactIn1Hop_nativeOut.snap
@@ -1 +1 @@
-118996
+119047
diff --git a/.forge-snapshots/V4Router_ExactIn1Hop_oneForZero.snap b/.forge-snapshots/V4Router_ExactIn1Hop_oneForZero.snap
@@ -1 +1 @@
-127868
+127919
diff --git a/.forge-snapshots/V4Router_ExactIn1Hop_zeroForOne.snap b/.forge-snapshots/V4Router_ExactIn1Hop_zeroForOne.snap
@@ -1 +1 @@
-134698
+134749
diff --git a/.forge-snapshots/V4Router_ExactIn2Hops.snap b/.forge-snapshots/V4Router_ExactIn2Hops.snap
@@ -1 +1 @@
-186239
+186290
diff --git a/.forge-snapshots/V4Router_ExactIn2Hops_nativeIn.snap b/.forge-snapshots/V4Router_ExactIn2Hops_nativeIn.snap
@@ -1 +1 @@
-178174
+178225
diff --git a/.forge-snapshots/V4Router_ExactIn3Hops.snap b/.forge-snapshots/V4Router_ExactIn3Hops.snap
@@ -1 +1 @@
-237761
+237812
diff --git a/.forge-snapshots/V4Router_ExactIn3Hops_nativeIn.snap b/.forge-snapshots/V4Router_ExactIn3Hops_nativeIn.snap
@@ -1 +1 @@
-229720
+229771
diff --git a/.forge-snapshots/V4Router_ExactInputSingle.snap b/.forge-snapshots/V4Router_ExactInputSingle.snap
@@ -1 +1 @@
-133506
+133557
diff --git a/.forge-snapshots/V4Router_ExactInputSingle_nativeIn.snap b/.forge-snapshots/V4Router_ExactInputSingle_nativeIn.snap
@@ -1 +1 @@
-118609
+118660
diff --git a/.forge-snapshots/V4Router_ExactInputSingle_nativeOut.snap b/.forge-snapshots/V4Router_ExactInputSingle_nativeOut.snap
@@ -1 +1 @@
-117782
+117833
diff --git a/.forge-snapshots/V4Router_ExactOut1Hop_nativeIn_sweepETH.snap b/.forge-snapshots/V4Router_ExactOut1Hop_nativeIn_sweepETH.snap
@@ -1 +1 @@
-125530
+125581
diff --git a/.forge-snapshots/V4Router_ExactOut1Hop_nativeOut.snap b/.forge-snapshots/V4Router_ExactOut1Hop_nativeOut.snap
@@ -1 +1 @@
-119808
+119859
diff --git a/.forge-snapshots/V4Router_ExactOut1Hop_oneForZero.snap b/.forge-snapshots/V4Router_ExactOut1Hop_oneForZero.snap
@@ -1 +1 @@
-128680
+128731
diff --git a/.forge-snapshots/V4Router_ExactOut1Hop_zeroForOne.snap b/.forge-snapshots/V4Router_ExactOut1Hop_zeroForOne.snap
@@ -1 +1 @@
-133481
+133532
diff --git a/.forge-snapshots/V4Router_ExactOut2Hops.snap b/.forge-snapshots/V4Router_ExactOut2Hops.snap
@@ -1 +1 @@
-185625
+185676
diff --git a/.forge-snapshots/V4Router_ExactOut2Hops_nativeIn.snap b/.forge-snapshots/V4Router_ExactOut2Hops_nativeIn.snap
@@ -1 +1 @@
-182475
+182526
diff --git a/.forge-snapshots/V4Router_ExactOut3Hops.snap b/.forge-snapshots/V4Router_ExactOut3Hops.snap
@@ -1 +1 @@
-237765
+237816
diff --git a/.forge-snapshots/V4Router_ExactOut3Hops_nativeIn.snap b/.forge-snapshots/V4Router_ExactOut3Hops_nativeIn.snap
@@ -1 +1 @@
-234639
+234690
diff --git a/.forge-snapshots/V4Router_ExactOut3Hops_nativeOut.snap b/.forge-snapshots/V4Router_ExactOut3Hops_nativeOut.snap
@@ -1 +1 @@
-228917
+228968
diff --git a/.forge-snapshots/V4Router_ExactOutputSingle.snap b/.forge-snapshots/V4Router_ExactOutputSingle.snap
@@ -1 +1 @@
-132278
+132329
diff --git a/.forge-snapshots/V4Router_ExactOutputSingle_nativeIn_sweepETH.snap b/.forge-snapshots/V4Router_ExactOutputSingle_nativeIn_sweepETH.snap
@@ -1 +1 @@
-124327
+124378
diff --git a/.forge-snapshots/V4Router_ExactOutputSingle_nativeOut.snap b/.forge-snapshots/V4Router_ExactOutputSingle_nativeOut.snap
@@ -1 +1 @@
-118618
+118669
diff --git a/src/libraries/CalldataDecoder.sol b/src/libraries/CalldataDecoder.sol
@@ -14,6 +14,10 @@ library CalldataDecoder {
     /// @notice equivalent to SliceOutOfBounds.selector
     bytes4 constant SLICE_ERROR_SELECTOR = 0x3b99b53d;
 
+    /// @notice mask used for offsets and lengths to ensure no overflow
+    /// @dev no sane abi encoding will pass in an offset or length greater than type(uint32).max
+    uint256 constant OFFSET_OR_LENGTH_MASK = 0xffffffff;
+
     /// @dev equivalent to: abi.decode(params, (bytes, bytes[])) in calldata
     function decodeActionsRouterParams(bytes calldata _bytes)
         internal
@@ -246,19 +250,21 @@ library CalldataDecoder {
     function toBytesArray(bytes calldata _bytes, uint256 _arg) internal pure returns (bytes[] calldata res) {
         uint256 encodingLength;
         assembly ("memory-safe") {
+            let bytesOffset := and(_bytes.offset, OFFSET_OR_LENGTH_MASK)
             // The offset of the `_arg`-th element is `32 * arg`, which stores the offset of the length pointer.
             // shl(5, x) is equivalent to mul(32, x)
-            let lengthPtr := add(_bytes.offset, calldataload(add(_bytes.offset, shl(5, _arg))))
+            let lengthPtr := and(add(bytesOffset, calldataload(add(bytesOffset, shl(5, _arg)))), OFFSET_OR_LENGTH_MASK)
             // the number of byte strings in the byte array
-            let arrayLength := calldataload(lengthPtr)
+            let arrayLength := and(calldataload(lengthPtr), OFFSET_OR_LENGTH_MASK)
             // pointer to encoding of the final bytes string in the array is `32 * arrayLength`
-            let finalElementLengthPtr := add(add(lengthPtr, 0x20), calldataload(add(lengthPtr, shl(5, arrayLength))))
+            let finalElementLengthPtr :=
+                and(add(add(lengthPtr, 0x20), calldataload(add(lengthPtr, shl(5, arrayLength)))), OFFSET_OR_LENGTH_MASK)
             // the length of the final bytes string
-            let finalElementLength := calldataload(finalElementLengthPtr)
+            let finalElementLength := and(calldataload(finalElementLengthPtr), OFFSET_OR_LENGTH_MASK)
             // the final bytes string's encoding is: 32 byte length, then the `length` bytes
             let finalElementEnd := add(add(finalElementLengthPtr, finalElementLength), 0x20)
             // total length needed in the calldata bytes array
-            encodingLength := sub(finalElementEnd, _bytes.offset)
+            encodingLength := sub(finalElementEnd, bytesOffset)
 
             // the start of the bytes string encoding is the slot after the length
             let arrayOffset := add(lengthPtr, 0x20)