Merge pull request #2378 from CosmWasm/co/patch-on-main

Merge patch to main

Author: chipshort

CHANGELOG.md

@@ -28,11 +28,13 @@ and this project adheres to
   `len` argument to allow truncating address data as part of the generation
   process. ([#2155])
 - cosmwasm-vm: Updated wasmer to 5.0.4 ([#2374])
+- cosmwasm-vm: Charge gas for `write_region` ([#2378])
 
 ## Fixed
 
 - cosmwasm-schema: The schema export now doesn't overwrite existing
   `additionalProperties` values anymore ([#2310])
+- cosmwasm-vm: Fix CWA-2025-002.
 
 [#2155]: https://github.com/CosmWasm/cosmwasm/issues/2155
 [#2268]: https://github.com/CosmWasm/cosmwasm/issues/2268
@@ -41,7 +43,8 @@ and this project adheres to
 [#2337]: https://github.com/CosmWasm/cosmwasm/issues/2337
 [#2340]: https://github.com/CosmWasm/cosmwasm/pull/2340
 [#2344]: https://github.com/CosmWasm/cosmwasm/pull/2344
-[#2374]: https://github.com/CosmWasm/cosmwasm/issues/2155
+[#2374]: https://github.com/CosmWasm/cosmwasm/issues/2374
+[#2378]: https://github.com/CosmWasm/cosmwasm/issues/2378
 
 ## [2.2.0] - 2024-12-17
 

contracts/hackatom/tests/integration.rs

@@ -435,7 +435,7 @@ fn execute_allocate_large_memory() {
     // Gas consumption is relatively small
     // Note: the exact gas usage depends on the Rust version used to compile Wasm,
     // which we only fix when using rust-optimizer, not integration tests.
-    let expected = 9553320; // +/- 20%
+    let expected = 12162675; // +/- 20%
     assert!(gas_used > expected * 80 / 100, "Gas used: {gas_used}");
     assert!(gas_used < expected * 120 / 100, "Gas used: {gas_used}");
     let used = deps.memory_pages();

packages/vm/src/environment.rs

@@ -55,6 +55,16 @@ pub struct GasConfig {
     pub bls12_381_hash_to_g2_cost: u64,
     /// bls12-381 pairing equality check cost
     pub bls12_381_pairing_equality_cost: LinearGasCost,
+    /// cost for writing memory regions
+    pub write_region_cost: LinearGasCost,
+    /// cost for reading memory regions <= 8MB
+    pub read_region_small_cost: LinearGasCost,
+    /// cost for reading memory regions > 8MB
+    pub read_region_large_cost: LinearGasCost,
+    /// cost for validating bytes into a String
+    pub string_from_bytes_cost: LinearGasCost,
+    /// cost for calling a host function
+    pub host_call_cost: u64,
 }
 
 impl Default for GasConfig {
@@ -97,6 +107,34 @@ impl Default for GasConfig {
                 base: 2112 * GAS_PER_US,
                 per_item: 163 * GAS_PER_US,
             },
+            write_region_cost: LinearGasCost {
+                base: 230000,
+                per_item: 570,
+            },
+            read_region_small_cost: LinearGasCost {
+                base: 200000,
+                per_item: 115,
+            },
+            read_region_large_cost: LinearGasCost {
+                base: 0,
+                per_item: 520,
+            },
+            string_from_bytes_cost: LinearGasCost {
+                base: 28700,
+                per_item: 1400,
+            },
+            host_call_cost: 18000,
+        }
+    }
+}
+
+impl GasConfig {
+    pub fn read_region_cost(&self, bytes: usize) -> VmResult<u64> {
+        const THRESHOLD: usize = 8 * 1000 * 1000;
+        if bytes <= THRESHOLD {
+            self.read_region_small_cost.total_cost(bytes as u64)
+        } else {
+            self.read_region_large_cost.total_cost(bytes as u64)
         }
     }
 }
@@ -115,8 +153,13 @@ pub struct LinearGasCost {
 }
 
 impl LinearGasCost {
-    pub fn total_cost(&self, items: u64) -> u64 {
-        self.base + self.per_item * items
+    pub fn total_cost(&self, items: u64) -> VmResult<u64> {
+        self.total_cost_opt(items)
+            .ok_or_else(VmError::gas_depletion)
+    }
+
+    fn total_cost_opt(&self, items: u64) -> Option<u64> {
+        self.base.checked_add(self.per_item.checked_mul(items)?)
     }
 }