Add checks to ERC7579Utils.decodeBatch

contracts/account/utils/draft-ERC4337Utils.sol

@@ -99,6 +99,33 @@ library ERC4337Utils {
         return result;
     }
 
+    /// @dev Variant of {hash} that supports user operations in memory.
+    function hashMemory(
+        PackedUserOperation memory self,
+        address entrypoint,
+        uint256 chainid
+    ) internal pure returns (bytes32) {
+        bytes32 result = keccak256(
+            abi.encode(
+                keccak256(
+                    abi.encode(
+                        self.sender,
+                        self.nonce,
+                        keccak256(self.initCode),
+                        keccak256(self.callData),
+                        self.accountGasLimits,
+                        self.preVerificationGas,
+                        self.gasFees,
+                        keccak256(self.paymasterAndData)
+                    )
+                ),
+                entrypoint,
+                chainid
+            )
+        );
+        return result;
+    }
+
     /// @dev Returns `factory` from the {PackedUserOperation}, or address(0) if the initCode is empty or not properly formatted.
     function factory(PackedUserOperation calldata self) internal pure returns (address) {
         return self.initCode.length < 20 ? address(0) : address(bytes20(self.initCode[0:20]));

contracts/account/utils/draft-ERC7579Utils.sol

@@ -61,6 +61,9 @@ library ERC7579Utils {
     /// @dev The module type is not supported.
     error ERC7579UnsupportedModuleType(uint256 moduleTypeId);
 
+    /// @dev Input calldata not properly formatted and possibly malicious.
+    error ERC7579DecodingError();
+
     /// @dev Executes a single call.
     function execSingle(
         ExecType execType,
@@ -169,12 +172,34 @@ library ERC7579Utils {
     }
 
     /// @dev Decodes a batch of executions. See {encodeBatch}.
+    ///
+    /// Note: This function runs some checks and will throw a {ERC7579DecodingError} if the input is not properly formatted.
     function decodeBatch(bytes calldata executionCalldata) internal pure returns (Execution[] calldata executionBatch) {
-        assembly ("memory-safe") {
-            let ptr := add(executionCalldata.offset, calldataload(executionCalldata.offset))
-            // Extract the ERC7579 Executions
-            executionBatch.offset := add(ptr, 32)
-            executionBatch.length := calldataload(ptr)
+        unchecked {
+            uint256 bufferLength = executionCalldata.length;
+
+            // Check executionCalldata is not empty
+            if (bufferLength < 32) revert ERC7579DecodingError();
+
+            // Get the offset of the array, and check its valid
+            uint256 offset = uint256(bytes32(executionCalldata[0:32]));
+
+            // Array length is between offset and offset + 32. We check that this is in the buffer
+            // Since we know executionCalldata is at least 32, we can subtract with no overflow risk.
+            if (offset > bufferLength - 32) revert ERC7579DecodingError();
+
+            // Get the array length
+            uint256 arrayLength = uint256(bytes32(executionCalldata[offset:offset + 32]));
+            if (arrayLength > type(uint64).max) revert ERC7579DecodingError();
+
+            // Get the array as a bytes slice, and check its is long enough
+            bytes calldata executionArray = executionCalldata[offset + 32:];
+            if (executionArray.length < arrayLength * 96) revert ERC7579DecodingError();
+
+            assembly ("memory-safe") {
+                executionBatch.offset := executionArray.offset
+                executionBatch.length := arrayLength
+            }
         }
     }
 

foundry.toml

@@ -8,6 +8,7 @@ out = 'out'
 libs = ['node_modules', 'lib']
 test = 'test'
 cache_path  = 'cache_forge'
+fs_permissions = [{ access = "read", path = "./test/bin" }]
 
 [fuzz]
 runs = 5000