fix(clearsign-abi): reject Solidity types that do not exist

encode_static_args accepted uint7, uint0 and int264 and emitted plausible
32-byte words for them, so a fixture could read as a real ABI encoding while
encoding a type no compiler can produce. bool coerced truthiness, turning
'false', 0.0 or 2 into ABI true/false. bytes0 was accepted, and bytes33 was
worse than invalid: ljust() does not truncate, so a 33-byte value emitted a
33-byte word and shifted every following argument one byte to the right --
silently corrupt calldata.

Validate intN/uintN widths as 8..256 in steps of 8, require an actual bool,
and restrict fixed bytes to bytes1..bytes32. Arrays now reach the existing
dynamic-type error instead of being parsed as a width.

All 51 catalog flows still build unchanged.

Author: pastaghost

keepkeylib/clearsign_abi.py

@@ -45,18 +45,46 @@ def _addr_word(address):
     return b'\x00' * 12 + address
 
 
+def _int_bits(digits, typ):
+    """Validate and return the bit width of a Solidity intN/uintN type.
+
+    Solidity defines uint8..uint256 and int8..int256 in steps of 8, plus the
+    bare `uint`/`int` aliases for 256. Nothing else exists. Accepting `uint7`,
+    `uint0` or `int264` here does not produce unusual calldata -- it produces
+    32-byte words for a type no compiler will ever emit, so the fixture reads
+    as a real ABI encoding while encoding a fiction. Fail loudly instead.
+    """
+    if digits == '':
+        return 256
+    if not digits.isdigit():
+        raise ValueError(
+            'unsupported type %r -- expected %s8..%s256 in steps of 8'
+            % (typ, typ[:-len(digits)], typ[:-len(digits)]))
+    bits = int(digits)
+    if bits < 8 or bits > 256 or bits % 8 != 0:
+        raise ValueError(
+            'invalid Solidity integer width in %r -- must be 8..256 '
+            'in steps of 8' % typ)
+    return bits
+
+
 def encode_static_args(types, values):
     """ABI-encode STATIC Solidity types into concatenated 32-byte words.
     Raises on any dynamic type (string/bytes/arrays) — build those by hand."""
     assert len(types) == len(values), (
         'arg count mismatch: %d types, %d values' % (len(types), len(values)))
     out = bytearray()
     for typ, val in zip(types, values):
+        # Route arrays to the explicit dynamic-type error below rather than
+        # letting 'uint256[]' reach the width parser as digits '256[]'.
+        if typ.endswith(']'):
+            raise ValueError(
+                'dynamic/unsupported type %r — build this call by hand '
+                '(see module docstring)' % typ)
         if typ == 'address':
             out += _addr_word(val)
         elif typ.startswith('uint'):
-            digits = typ[4:]
-            bits = int(digits) if digits else 256
+            bits = _int_bits(typ[4:], typ)
             n = int(val)
             assert 0 <= n < (1 << bits), (
                 'value %r out of range for %s' % (val, typ))
@@ -68,17 +96,32 @@ def encode_static_args(types, values):
             # every negative value and silently accepted values at or above
             # 2^(N-1), which the EVM reads back as NEGATIVE -- calldata that
             # does not mean what the declared type says.
-            digits = typ[3:]
-            bits = int(digits) if digits else 256
+            bits = _int_bits(typ[3:], typ)
             n = int(val)
             lo, hi = -(1 << (bits - 1)), (1 << (bits - 1)) - 1
             assert lo <= n <= hi, (
                 'value %r out of range for %s (%d..%d)' % (val, typ, lo, hi))
             out += n.to_bytes(32, 'big', signed=True)
         elif typ == 'bool':
+            # Require an actual bool. Coercing truthiness here silently turns
+            # 'false', 0.0 or 2 into ABI true/false, and a fixture that says
+            # bool should not be the place a type confusion is laundered.
+            if not isinstance(val, bool):
+                raise ValueError(
+                    'bool argument must be a real bool, got %r (%s)'
+                    % (val, type(val).__name__))
             out += (1 if val else 0).to_bytes(32, 'big')
         elif typ.startswith('bytes') and typ != 'bytes' and not typ.endswith('[]'):
-            n = int(typ[5:])
+            digits = typ[5:]
+            # bytes1..bytes32 only. bytes0 is not a Solidity type, and bytes33
+            # is worse than invalid: ljust() does not truncate, so a 33-byte
+            # value emitted a 33-byte "word" and shifted every following
+            # argument by one byte -- silently corrupt calldata.
+            if not digits.isdigit() or not 1 <= int(digits) <= 32:
+                raise ValueError(
+                    'invalid fixed-bytes type %r -- must be bytes1..bytes32'
+                    % typ)
+            n = int(digits)
             b = val if isinstance(val, (bytes, bytearray)) else bytes.fromhex(
                 val[2:] if val.startswith('0x') else val)
             assert len(b) == n, 'bytes%d value has wrong length' % n

tests/test_clearsign_abi.py

@@ -31,5 +31,57 @@ def test_uint8_keeps_unsigned_bounds(self):
                 encode_static_args(['uint8'], [value])
 
 
+class TestClearsignAbiTypeValidation(unittest.TestCase):
+    """The encoder must refuse types Solidity does not have.
+
+    Emitting a plausible 32-byte word for `uint7` or `int264` makes a fixture
+    read as a real ABI encoding while encoding a type no compiler can produce.
+    """
+
+    def test_non_multiple_of_eight_widths_are_rejected(self):
+        for typ in ('uint7', 'int7', 'uint255', 'int13'):
+            with self.assertRaises(ValueError):
+                encode_static_args([typ], [1])
+
+    def test_zero_and_oversized_widths_are_rejected(self):
+        for typ in ('uint0', 'int0', 'uint264', 'int264', 'uint512'):
+            with self.assertRaises(ValueError):
+                encode_static_args([typ], [0])
+
+    def test_valid_widths_still_encode(self):
+        for typ in ('uint8', 'uint16', 'uint256', 'uint', 'int8', 'int256', 'int'):
+            self.assertEqual(len(encode_static_args([typ], [1])), 32)
+
+    def test_bool_requires_an_actual_bool(self):
+        # 1 and 'false' would both have become ABI true.
+        for val in (1, 0, 'false', 'true', 2, None):
+            with self.assertRaises(ValueError):
+                encode_static_args(['bool'], [val])
+        self.assertEqual(encode_static_args(['bool'], [True]),
+                         b'\x00' * 31 + b'\x01')
+        self.assertEqual(encode_static_args(['bool'], [False]), b'\x00' * 32)
+
+    def test_fixed_bytes_width_is_bounded(self):
+        for typ in ('bytes0', 'bytes33', 'bytes64'):
+            with self.assertRaises(ValueError):
+                encode_static_args([typ], [b'\x11' * 32])
+
+    def test_oversized_fixed_bytes_cannot_shift_later_arguments(self):
+        """bytes33 used to emit 33 bytes -- ljust does not truncate -- which
+        pushed every following argument one byte to the right."""
+        with self.assertRaises(ValueError):
+            encode_static_args(['bytes33', 'uint256'], [b'\x11' * 33, 1])
+
+    def test_valid_fixed_bytes_still_encode_left_aligned(self):
+        self.assertEqual(encode_static_args(['bytes1'], [b'\xab']),
+                         b'\xab' + b'\x00' * 31)
+        self.assertEqual(len(encode_static_args(['bytes32'], [b'\x11' * 32])), 32)
+
+    def test_arrays_report_the_dynamic_type_error(self):
+        for typ in ('uint256[]', 'address[]', 'uint256[2]'):
+            with self.assertRaisesRegex(ValueError, 'dynamic/unsupported type'):
+                encode_static_args([typ], [[1]])
+
+
 if __name__ == '__main__':
     unittest.main()