From d9f9fdadd81a148cbc68f02dbbbcdc0c92fad652 Mon Sep 17 00:00:00 2001 From: Charles Cooper Date: Thu, 30 May 2024 05:22:47 -0700 Subject: [PATCH] fix[ir]: fix a latent bug in `sha3_64` codegen (#4063) this commit fixes a latent bug in `sha3_64` asm generation, where the second argument to `sha3_64` is generated with the wrong stack height note the bug cannot currently be triggered from vyper source code (hence, it is latent), because there is nowhere in IR generation that the second item is accessed as a witharg. patches GHSA-6845-xw22-ffxv --- vyper/ir/compile_ir.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/vyper/ir/compile_ir.py b/vyper/ir/compile_ir.py index 472d28f4fb..4c68aa2c8f 100644 --- a/vyper/ir/compile_ir.py +++ b/vyper/ir/compile_ir.py @@ -580,7 +580,9 @@ def _height_of(witharg): # SHA3 a 64 byte value elif code.value == "sha3_64": o = _compile_to_assembly(code.args[0], withargs, existing_labels, break_dest, height) - o.extend(_compile_to_assembly(code.args[1], withargs, existing_labels, break_dest, height)) + o.extend( + _compile_to_assembly(code.args[1], withargs, existing_labels, break_dest, height + 1) + ) o.extend( [ *PUSH(MemoryPositions.FREE_VAR_SPACE2),