Skip to content

Fix unset internal function pointer retrieval from packed storage slot with a subsequent non-zero variable - #16776

Open
matheusaaguiar wants to merge 3 commits into
developfrom
fixUnsetInternalFunctionPointerStorageRetrieval
Open

Fix unset internal function pointer retrieval from packed storage slot with a subsequent non-zero variable#16776
matheusaaguiar wants to merge 3 commits into
developfrom
fixUnsetInternalFunctionPointerStorageRetrieval

Conversation

@matheusaaguiar

@matheusaaguiar matheusaaguiar commented May 27, 2026

Copy link
Copy Markdown
Contributor

Fix #16775.

@matheusaaguiar matheusaaguiar self-assigned this May 27, 2026
@matheusaaguiar
matheusaaguiar force-pushed the fixUnsetInternalFunctionPointerStorageRetrieval branch 2 times, most recently from af2e5cb to fe6c6bd Compare May 27, 2026 08:15
@github-actions github-actions Bot added the stale The issue/PR was marked as stale because it has been open for too long. label Jun 10, 2026
@matheusaaguiar matheusaaguiar removed the stale The issue/PR was marked as stale because it has been open for too long. label Jun 15, 2026
@argotorg argotorg deleted a comment from github-actions Bot Jun 15, 2026
@matheusaaguiar
matheusaaguiar force-pushed the fixUnsetInternalFunctionPointerStorageRetrieval branch from fe6c6bd to fc400a5 Compare June 15, 2026 15:08
@github-actions github-actions Bot added the stale The issue/PR was marked as stale because it has been open for too long. label Jun 30, 2026
@cameel cameel removed the stale The issue/PR was marked as stale because it has been open for too long. label Jul 5, 2026
@argotorg argotorg deleted a comment from github-actions Bot Jul 19, 2026
@matheusaaguiar
matheusaaguiar force-pushed the fixUnsetInternalFunctionPointerStorageRetrieval branch from fc400a5 to 0eae968 Compare August 3, 2026 22:46
Comment thread libsolidity/codegen/LValue.cpp Outdated
if (type->category() == Type::Category::UserDefinedValueType)
type = type->encodingType();
bool cleaned = false;
// shift bytes to the right positioning the function pointer at the start of the slot

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am a bit confused about this comment. retrieveValue is a general method, no? It deals with all types, not only function pointers.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, true. I guess I got to much focused on function pointers at the time 😅
I will change it to state variable, ok?

// shift bytes to the right positioning the function pointer at the start of the slot
m_context
<< Instruction::SWAP1 << s_loadInstruction << Instruction::SWAP1
<< u256(0x100) << Instruction::EXP << Instruction::SWAP1 << Instruction::DIV;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Side note: If this is supposed to do shift, it does not need to use EXP instruction for that.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DIV does the right shifting. I am trying to remember exactly, but I think that EXP is just telling by how much you shift.
I will confirm this.

@matheusaaguiar matheusaaguiar Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, just for clarity, I think this uses DIV (and other places MUL) because shift opcodes were introduced in later EVM versions.

@matheusaaguiar matheusaaguiar Aug 7, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had "decoded" this before, but it was used with MUL in another place.
The variable offset is given in bytes, EXP 0x100, offset computes the amount of bits to shift when using DIV.

256^offset = (2^8)^offset = 2^8 * offset.

When the bytes of the slot are divided by this value, it is equivalent to shifting it 8 * offset bits to the right.

@matheusaaguiar
matheusaaguiar force-pushed the fixUnsetInternalFunctionPointerStorageRetrieval branch from 0eae968 to 7f82e49 Compare August 7, 2026 02:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

3 participants