Version Information
- vyper Version: current
master (242a4fa7d locally), with --experimental-codegen
- OS: macOS
- Python Version: 3.12 via
uv run --python 3.12
What's your issue about?
Venom AugAssign lowering does not appear to port the legacy read/write overlap guard that was added for GHSA-4w26-8p97-f4jp.
Legacy codegen rejects augmented assignments whose RHS can mutate the LHS target. That protection lives in codegen, not semantic analysis. In the Venom path, lower_AugAssign computes the target pointer and loads the current value before lowering the RHS, with no equivalent read_write_overlap / contains_writeable_call check.
Two bad consequences follow from the same ordering:
- For a dynamic-array target such as
self.a[1] += self.side_effect(), if the side effect shrinks/pops self.a, the element pointer can be computed and bounds-checked against the old length and then written after the array has changed.
- For a scalar target such as
self.x += self.f() where f() writes self.x, Venom can load the old target before the RHS side effect. Legacy rejects this class outright.
This looks like a regression of the codegen-layer guard from the advisory class.
How can it be fixed?
Port the legacy overlap check to Venom augmented assignment lowering and raise before codegen for disallowed RHS/LHS combinations.
Version Information
master(242a4fa7dlocally), with--experimental-codegenuv run --python 3.12What's your issue about?
Venom
AugAssignlowering does not appear to port the legacy read/write overlap guard that was added for GHSA-4w26-8p97-f4jp.Legacy codegen rejects augmented assignments whose RHS can mutate the LHS target. That protection lives in codegen, not semantic analysis. In the Venom path,
lower_AugAssigncomputes the target pointer and loads the current value before lowering the RHS, with no equivalentread_write_overlap/contains_writeable_callcheck.Two bad consequences follow from the same ordering:
self.a[1] += self.side_effect(), if the side effect shrinks/popsself.a, the element pointer can be computed and bounds-checked against the old length and then written after the array has changed.self.x += self.f()wheref()writesself.x, Venom can load the old target before the RHS side effect. Legacy rejects this class outright.This looks like a regression of the codegen-layer guard from the advisory class.
How can it be fixed?
Port the legacy overlap check to Venom augmented assignment lowering and raise before codegen for disallowed RHS/LHS combinations.