Skip to content

Hotfix adjust metadata origin retention#940

Closed
jberthold wants to merge 2 commits intomasterfrom
HOTFIX-adjust-metadata-origin-retention
Closed

Hotfix adjust metadata origin retention#940
jberthold wants to merge 2 commits intomasterfrom
HOTFIX-adjust-metadata-origin-retention

Conversation

@jberthold
Copy link
Member

  • When creating a reference or pointer, set the original size to the same as the current size (was noMetadataSize before)
  • When casting a pointer, always retain the original size, not the size of the previous pointer.

This makes the iter_next_2 test pass, i.e., the iterator's end is recognised correctly.

@jberthold jberthold marked this pull request as ready for review February 13, 2026 04:04
Copy link
Collaborator

@dkcumming dkcumming left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am fairly sure this would allow UB if a pointer offsets beyond the bounds of collection. The ORIGIN_SIZE field is how big the collection of elements is that the pointer is inside of. Copying the SIZE to ORIGIN_SIZE will mean we are modeling the pointer in a collection bigger than what it is - thus if an offset beyond the real boundary were to occur our model would not detect it if it were within the bounds of the copied SIZE.

Instead of this approach I did an investigation for iter_next_2-fail.rs to pinpoint where exactly the ORIGIN_SIZE was incorrectly instantiated . I found that it was a PtrToPtr cast that removed previously correct metadata (dynamicSize(_)) and replaced it with noMetadataSize.

I made a PR with the correction to that cast #941. Similarly with that correction (and the others from the work we did together on Friday) InitializeMultisig (P-Token) proof harness passes

@jberthold jberthold closed this Feb 18, 2026
@jberthold jberthold deleted the HOTFIX-adjust-metadata-origin-retention branch February 18, 2026 09:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants