Skip to content

fix(jsonrpc): harden ABI parser bounds and revert reason decoding#6711

Open
0xbigapple wants to merge 4 commits intotronprotocol:developfrom
0xbigapple:fix/abi-bounds-checks
Open

fix(jsonrpc): harden ABI parser bounds and revert reason decoding#6711
0xbigapple wants to merge 4 commits intotronprotocol:developfrom
0xbigapple:fix/abi-bounds-checks

Conversation

@0xbigapple
Copy link
Copy Markdown
Collaborator

What does this PR do?

This PR hardens ABI decoding for malformed dynamic data in both contract event parsing and JSON-RPC revert reason handling.

It:

  • in subBytes: rejects negative or out-of-bounds offsets/lengths (no longer silently truncates oversized lengths via min)
  • in parseDataBytes: rejects negative dynamic lengths instead of treating them as empty string / bytes
  • adds tryDecodeRevertReason to centralize duplicated revert error handling used by eth_call and eth_estimateGas
  • adds focused tests for parser bounds checks and revert reason decoding

Why are these changes required?

Previously, malformed ABI payloads could:

  • reach subBytes() with invalid offsets or oversized lengths
  • treat negative dynamic lengths as empty string / bytes
  • affect event handling and revert reason decoding in eth_call and eth_estimateGas

This PR has been tested by:

  • Unit Tests

    • :framework:test --tests org.tron.common.logsfilter.EventParserTest
    • :framework:test --tests org.tron.core.services.jsonrpc.TronJsonRpcRevertReasonTest
    • :framework:test --tests org.tron.core.jsonrpc.JsonRpcCallAndEstimateGasTest — end-to-end coverage of eth_call and eth_estimateGas over revert/non-revert` paths
  • Manual Testing

    • deployed a test contract to a local private chain
    • verified malformed revert payloads through eth_call
    • verified malformed revert payloads through eth_estimateGas
    • verified malformed event payloads through emitted logs

Follow up

Extra details

@github-actions github-actions Bot requested a review from bladehan1 April 28, 2026 06:17
@halibobo1205 halibobo1205 added topic:api rpc/http related issue topic:json-rpc labels Apr 28, 2026
@halibobo1205 halibobo1205 added this to the GreatVoyage-v4.8.2 milestone Apr 28, 2026
Comment thread framework/src/main/java/org/tron/core/services/jsonrpc/TronJsonRpcImpl.java Outdated
Comment thread framework/src/main/java/org/tron/core/services/jsonrpc/TronJsonRpcImpl.java Outdated
Comment thread framework/src/test/java/org/tron/core/jsonrpc/JsonRpcCallAndEstimateGasTest.java Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

topic:api rpc/http related issue topic:json-rpc

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants