fix(spammer): reject too many exponential generators instead of overflowing#138
Open
Jr-kenny wants to merge 1 commit into
Open
fix(spammer): reject too many exponential generators instead of overflowing#138Jr-kenny wants to merge 1 commit into
Jr-kenny wants to merge 1 commit into
Conversation
…lowing The guard in partition_exponential that should reject more generators than the account space can hold computes 1 << (num_generators - 1). Once that exponent reaches the word size the shift overflows, so the guard panics in debug builds and silently passes (with wrapped denominators) in release, producing garbage account ranges. Short-circuit on the shift width so the bail fires cleanly, and add a regression test.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #137
Problem
The guard in
partition_exponentialthat should reject more generators than the account space can hold computes1 << (num_generators - 1)before checking whether that exponent even fits in the word. Oncenum_generators - 1reaches 64 the shift itself overflows, so the friendly "too many generators" bail never gets to fire. Full walkthrough in the issue.What that looks like on current main with
partition_accounts(130, 65):accounts.rs:103with "attempt to shift left with overflow"Okwith garbage:The first generator gets all 130 accounts, the second gets an inverted range, and the tail ranges all overlap the first one, so generators collide on the same accounts and nonces.
Fix
Short-circuit the guard on the shift width. Once the exponent reaches the word size,
2^(num_generators - 1)already exceeds any possiblenum_accounts, so the smallest bucket is empty and bailing is the right answer anyway:This also keeps the boundary loop below safe, since it can no longer be reached with an out-of-range exponent.
Testing
(130, 65)and(200, 100), both now return the same graceful error as smaller over-subscriptions like(100, 9)