+
Skip to content

BitBuilder incorrectly allows exceeding the 1023-bit cell limit #76

@Gusarich

Description

@Gusarich

BitBuilder incorrectly allows writing more than the maximum permitted 1023 bits per cell, failing to throw an immediate overflow error. This results in invalid serialization that's detected only later, upon finalizing the cell.

Minimal Example:

import { beginCell } from "@ton/core";

const payload = Buffer.alloc(128, 0xff); // exactly 1024 bits (128 bytes)
const b = beginCell();
b.storeBuffer(payload); // writes 1024 bits without error (should overflow at 1023)

console.log("bits after payload:", b.bits); // incorrectly logs 1024 bits

b.storeBit(1); // writes an additional bit, total now 1025 bits

console.log("bits after extra bit:", b.bits); // incorrectly logs 1025 bits

try {
    b.endCell(); // delayed overflow detection here
} catch (e) {
    console.log("error:", e.message); // => "Bits overflow: 1025 > 1023"
}

Expected Behavior:
The builder should immediately throw an overflow error as soon as the bit count exceeds 1023 bits.

Actual Behavior:
No immediate error is raised. The bit count reaches 1025 bits, and the overflow error is thrown only during finalization (endCell()), potentially masking subtle serialization issues in production environments.


LLM Fuzzing discovery (see tact-lang/tact#3123)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      点击 这是indexloc提供的php浏览器服务,不要输入任何密码和下载