[SECURITY] Integer overflow when casting to usize in BLOBHASH opcode

[pventuzelo]

Our team at https://github.com/FuzzingLabs discovered a bug in the op_blobhash function, this bug can lead to a panic when casting to usize.

Root cause

    pub fn op_blobhash(
        &mut self,
        current_call_frame: &mut CallFrame,
    ) -> Result<OpcodeSuccess, VMError> {
        self.increase_consumed_gas(current_call_frame, gas_cost::BLOBHASH)?;

        let index = current_call_frame.stack.pop()?.as_usize();

        let blob_hash: H256 = match &self.env.tx_blob_hashes {
            Some(vec) => match vec.get(index) {
                Some(el) => *el,
                None => {
                    return Err(VMError::BlobHashIndexOutOfBounds);
                }
            },
            None => {
                return Err(VMError::MissingBlobHashes);
            }
        };

        // Could not find a better way to translate from H256 to U256
        let u256_blob = U256::from(blob_hash.as_bytes());

        current_call_frame.stack.push(u256_blob)?;

        Ok(OpcodeSuccess::Continue)
    }

let index = current_call_frame.stack.pop()?.as_usize(); We can give a value greater than usize's maximum length to trigger an overflow because stack.pop() will return a U256.

Step to reproduce

Payload

[71, 73]

SELFBALANCE
BLOBHASH

Add to [test](https://github.com/lambdaclass/lambda_ethereum_rust/blob/main/crates/vm/levm/tests/tests.rs) :

#[test]
fn test_usize_overflow_blobhash() {
    let mut vm = new_vm_with_bytecode(Bytes::copy_from_slice(&[71, 73]));
    let mut current_call_frame = vm.call_frames.pop().unwrap();
    vm.execute(&mut current_call_frame);
}

Backtrace

---- tests::test_usize_overflow_blobhash stdout ----
thread 'tests::test_usize_overflow_blobhash' panicked at /home/.../.cargo/registry/src/index.crates.io-6f17d22bba15001f/primitive-types-0.12.2/src/lib.rs:38:1:
Integer overflow when casting to usize
stack backtrace:
   0: rust_begin_unwind
             at /rustc/59e2c01c2217a01546222e4d9ff4e6695ee8a1db/library/std/src/panicking.rs:658:5
   1: core::panicking::panic_fmt
             at /rustc/59e2c01c2217a01546222e4d9ff4e6695ee8a1db/library/core/src/panicking.rs:74:14
   2: primitive_types::U256::as_usize
             at /home/mhoste/.cargo/registry/src/index.crates.io-6f17d22bba15001f/uint-0.9.5/src/uint.rs:661:6
   3: ethereum_rust_levm::opcode_handlers::block::<impl ethereum_rust_levm::vm::VM>::op_blobhash
             at ./src/opcode_handlers/block.rs:167:21
   4: ethereum_rust_levm::vm::VM::execute
             at ./src/vm.rs:186:37
   5: lib::tests::test_usize_overflow_blobhash
             at ./tests/tests.rs:103:5
   6: lib::tests::test_usize_overflow_blobhash::{{closure}}
             at ./tests/tests.rs:100:34
   7: core::ops::function::FnOnce::call_once
             at /rustc/59e2c01c2217a01546222e4d9ff4e6695ee8a1db/library/core/src/ops/function.rs:250:5
   8: core::ops::function::FnOnce::call_once
             at /rustc/59e2c01c2217a01546222e4d9ff4e6695ee8a1db/library/core/src/ops/function.rs:250:5