From 7207d8fb53867f464ba47501bd8571763cd7ad87 Mon Sep 17 00:00:00 2001 From: lau90eth Date: Sun, 28 Jun 2026 10:07:59 +0200 Subject: [PATCH 1/2] fix: check empty leader nondet result before indexing data[0] Fixes index-out-of-bounds panic when a malicious leader injects Bytes::new() as a nondet result. data[0] would panic if data is empty. Affected: executor/src/wasi/genlayer_sdk.rs ~L1305 PoC: https://github.com/lau90eth/genvm-nondet-panic --- executor/src/wasi/genlayer_sdk.rs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/executor/src/wasi/genlayer_sdk.rs b/executor/src/wasi/genlayer_sdk.rs index 804f8fa2c..1d2d1b9fa 100644 --- a/executor/src/wasi/genlayer_sdk.rs +++ b/executor/src/wasi/genlayer_sdk.rs @@ -1301,6 +1301,11 @@ impl ContextVFS<'_> { } Some(data) => { use crate::public_abi::ResultCode; + if data.is_empty() { + return Err(generated::types::Error::trap( + crate::anyhow_to_wasmtime(anyhow::anyhow!("leader nondet result is empty")) + )); + } let rest = &data[1..]; let res = match data[0] { x if x == ResultCode::Return as u8 => rt::vm::RunOk::Return(rest.into()), From 32dc8e786f031fca5fcb8272273d8794f711deb5 Mon Sep 17 00:00:00 2001 From: lau90eth Date: Sun, 28 Jun 2026 10:12:57 +0200 Subject: [PATCH 2/2] fix: limit Vec::with_capacity in bin.rs to prevent OOM Adds MAX_ARRAY_CAPACITY guard before Vec::with_capacity(full_size) in the binary calldata decoder. Without this check, a malicious calldata packet with a large array size field causes OOM allocation. Affected: executor/crates/calldata/src/bin.rs:214 PoC: https://github.com/lau90eth/genvm-bin-oom --- executor/crates/calldata/src/bin.rs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/executor/crates/calldata/src/bin.rs b/executor/crates/calldata/src/bin.rs index 1116a961e..39f83ed42 100644 --- a/executor/crates/calldata/src/bin.rs +++ b/executor/crates/calldata/src/bin.rs @@ -210,6 +210,10 @@ impl Parser<'_> { if full_size == 0 { Value::Array(Vec::new()) } else { + const MAX_ARRAY_CAPACITY: usize = 1024 * 1024; // 1M elements max + if full_size > MAX_ARRAY_CAPACITY { + return Err(anyhow::anyhow!("array capacity too large: {}", full_size)); + } stack.push(Frame::Array { collected: Vec::with_capacity(full_size), remaining: full_size,