fix: ABI decoder crashing on certain inputs

packages/fuels-core/src/codec/abi_decoder.rs

@@ -28,7 +28,7 @@ impl Default for DecoderConfig {
 
 #[derive(Default)]
 pub struct ABIDecoder {
-    config: DecoderConfig,
+    pub config: DecoderConfig,
 }
 
 impl ABIDecoder {
@@ -84,11 +84,13 @@ mod tests {
     use std::vec;
 
     use super::*;
+    use crate::traits::Parameterize;
     use crate::types::U256;
     use crate::{
         constants::WORD_SIZE,
         types::{enum_variants::EnumVariants, errors::Error, StaticStringToken},
     };
+    use ParamType::*;
 
     #[test]
     fn decode_int() -> Result<()> {
@@ -521,6 +523,87 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    pub fn division_by_zero() {
+        let param_type = Vec::<[u16; 0]>::param_type();
+        let result = ABIDecoder::default().decode(&param_type, &[]);
+        assert!(matches!(result, Err(Error::InvalidType(_))));
+    }
+
+    #[test]
+    pub fn multiply_overflow_enum() {
+        let result = ABIDecoder::default().decode(
+            &Enum {
+                variants: EnumVariants::new(vec![
+                    Array(Box::new(Array(Box::new(RawSlice), 8)), usize::MAX),
+                    B256,
+                    B256,
+                    B256,
+                    B256,
+                    B256,
+                    B256,
+                    B256,
+                    B256,
+                    B256,
+                    B256,
+                ])
+                .unwrap(),
+                generics: vec![U16],
+            },
+            &[],
+        );
+        assert!(matches!(result, Err(Error::InvalidType(_))));
+    }
+
+    #[test]
+    pub fn multiply_overflow_vector() {
+        let param_type = Vec::<[(); usize::MAX]>::param_type();
+        let result = ABIDecoder::default().decode(&param_type, &[]);
+        assert!(matches!(result, Err(Error::InvalidData(_))));
+    }
+
+    #[test]
+    pub fn multiply_overflow_arith() {
+        let mut param_type: ParamType = U16;
+        for _ in 0..50 {
+            param_type = Array(Box::new(param_type), 8);
+        }
+        let result = ABIDecoder::default().decode(
+            &Enum {
+                variants: EnumVariants::new(vec![param_type]).unwrap(),
+                generics: vec![U16],
+            },
+            &[],
+        );
+        assert!(matches!(result, Err(Error::InvalidData(_))));
+    }
+
+    #[test]
+    pub fn capacity_overflow() {
+        let result = ABIDecoder::default().decode(
+            &Array(Box::new(Array(Box::new(Tuple(vec![])), usize::MAX)), 1),
+            &[],
+        );
+        assert!(matches!(result, Err(Error::InvalidType(_))));
+    }
+
+    #[test]
+    pub fn stack_overflow() {
+        let mut param_type: ParamType = U16;
+        for _ in 0..13500 {
+            param_type = Vector(Box::new(param_type));
+        }
+        let result = ABIDecoder::default().decode(&param_type, &[]);
+        assert!(matches!(result, Err(Error::InvalidType(_))));
+    }
+
+    #[test]
+    pub fn capacity_maloc() {
+        let param_type = Array(Box::new(U8), usize::MAX);
+        let result = ABIDecoder::default().decode(&param_type, &[]);
+        assert!(matches!(result, Err(Error::InvalidData(_))));
+    }
+
     #[test]
     fn decoding_enum_with_more_than_one_heap_type_variant_fails() -> Result<()> {
         let mut param_types = vec![

packages/fuels-core/src/codec/abi_decoder/bounded_decoder.rs

@@ -19,6 +19,7 @@ use crate::{
 pub(crate) struct BoundedDecoder {
     depth_tracker: CounterWithLimit,
     token_tracker: CounterWithLimit,
+    config: DecoderConfig,
 }
 
 const U128_BYTES_SIZE: usize = 2 * WORD_SIZE;
@@ -32,11 +33,12 @@ impl BoundedDecoder {
         Self {
             depth_tracker,
             token_tracker,
+            config,
         }
     }
 
     pub(crate) fn decode(&mut self, param_type: &ParamType, bytes: &[u8]) -> Result<Token> {
-        param_type.validate_is_decodable()?;
+        param_type.validate_is_decodable(self.config.max_depth)?;
         Ok(self.decode_param(param_type, bytes)?.token)
     }
 
@@ -46,7 +48,7 @@ impl BoundedDecoder {
         bytes: &[u8],
     ) -> Result<Vec<Token>> {
         for param_type in param_types {
-            param_type.validate_is_decodable()?;
+            param_type.validate_is_decodable(self.config.max_depth)?;
         }
         let (tokens, _) = self.decode_params(param_types, bytes)?;
 
@@ -297,17 +299,24 @@ impl BoundedDecoder {
     /// * `data`: slice of encoded data on whose beginning we're expecting an encoded enum
     /// * `variants`: all types that this particular enum type could hold
     fn decode_enum(&mut self, bytes: &[u8], variants: &EnumVariants) -> Result<Decoded> {
-        let enum_width = variants.compute_encoding_width_of_enum();
+        let enum_width = variants.compute_encoding_width_of_enum()?;
 
         let discriminant = peek_u32(bytes)? as u8;
         let selected_variant = variants.param_type_of_variant(discriminant)?;
+
         let skip_extra = variants
             .heap_type_variant()
             .is_some_and(|(heap_discriminant, _)| heap_discriminant == discriminant)
             .then_some(3);
-        let words_to_skip =
-            enum_width - selected_variant.compute_encoding_width() + skip_extra.unwrap_or_default();
-        let enum_content_bytes = skip(bytes, words_to_skip * WORD_SIZE)?;
+        let words_to_skip = enum_width - selected_variant.compute_encoding_width()?
+            + skip_extra.unwrap_or_default();
+        let bytes_to_skip = words_to_skip.checked_mul(WORD_SIZE).ok_or_else(|| {
+            error!(
+                InvalidData,
+                "Overflow error while decoding enum {variants:?}"
+            )
+        })?;
+        let enum_content_bytes = skip(bytes, bytes_to_skip)?;
         let result = self.decode_token_in_enum(enum_content_bytes, variants, selected_variant)?;
 
         let selector = Box::new((discriminant, result.token, variants.clone()));

packages/fuels-core/src/codec/abi_encoder.rs

@@ -115,7 +115,7 @@ impl ABIEncoder {
         // Enums that contain only Units as variants have only their discriminant encoded.
         if !variants.only_units_inside() {
             let variant_param_type = variants.param_type_of_variant(*discriminant)?;
-            let padding_amount = variants.compute_padding_amount(variant_param_type);
+            let padding_amount = variants.compute_padding_amount(variant_param_type)?;
 
             encoded_enum.push(Data::Inline(vec![0; padding_amount]));
 

packages/fuels-core/src/types/enum_variants.rs

@@ -47,27 +47,32 @@ impl EnumVariants {
     }
 
     /// Calculates how many WORDs are needed to encode an enum.
-    pub fn compute_encoding_width_of_enum(&self) -> usize {
+    pub fn compute_encoding_width_of_enum(&self) -> Result<usize> {
         if self.only_units_inside() {
-            return ENUM_DISCRIMINANT_WORD_WIDTH;
+            return Ok(ENUM_DISCRIMINANT_WORD_WIDTH);
         }
         self.param_types()
             .iter()
             .map(|p| p.compute_encoding_width())
+            .collect::<Result<Vec<_>>>()?
+            .iter()
             .max()
             .map(|width| width + ENUM_DISCRIMINANT_WORD_WIDTH)
-            .expect(
-                "Will never panic because EnumVariants must have at least one variant inside it!",
-            )
+            .ok_or_else(|| {
+                error!(
+                    InvalidData,
+                    "EnumVariants was empty, must have at least one variant"
+                )
+            })
     }
 
     /// Determines the padding needed for the provided enum variant (based on the width of the
     /// biggest variant) and returns it.
-    pub fn compute_padding_amount(&self, variant_param_type: &ParamType) -> usize {
+    pub fn compute_padding_amount(&self, variant_param_type: &ParamType) -> Result<usize> {
         let biggest_variant_width =
-            self.compute_encoding_width_of_enum() - ENUM_DISCRIMINANT_WORD_WIDTH;
-        let variant_width = variant_param_type.compute_encoding_width();
-        (biggest_variant_width - variant_width) * WORD_SIZE
+            self.compute_encoding_width_of_enum()? - ENUM_DISCRIMINANT_WORD_WIDTH;
+        let variant_width = variant_param_type.compute_encoding_width()?;
+        Ok((biggest_variant_width - variant_width) * WORD_SIZE)
     }
 }