Bugfix entry regarding nested arrays returned by library functions

4 files changed, 31 insertions, 10 deletions

diff --git a/circle.yml b/circle.yml
index fb504ba1..7c95fa7f 100644
--- a/circle.yml
+++ b/circle.yml
@@ -234,6 +234,7 @@ workflows:
   version: 2
   build_all:
     jobs:
+      - test_buglist: *build_on_tags
       - build_emscripten: *build_on_tags
       - test_emscripten_solcjs:
           <<: *build_on_tags
diff --git a/docs/bugs.json b/docs/bugs.json
index 28c0fe62..c1e377a4 100644
--- a/docs/bugs.json
+++ b/docs/bugs.json
@@ -17,13 +17,12 @@
         "check": {"ast-compact-json-path": "$..[?(@.nodeType === 'EventDefinition')]..[?(@.nodeType === 'UserDefinedTypeName' && @.typeDescriptions.typeString.startsWith('struct'))]"}
     },
     {
-        "name": "NestedArrayFunctionCallDecoder",
-        "summary": "Calling functions that return multi-dimensional fixed-size arrays can result in memory corruption.",
-        "description": "If Solidity code calls a function that returns a multi-dimensional fixed-size array, array elements are incorrectly interpreted as memory pointers and thus can cause memory corruption if the return values are accessed. Calling functions with multi-dimensional fixed-size arrays is unaffected as is returning fixed-size arrays from function calls. The regular expression only checks if such functions are present, not if they are called, which is required for the contract to be affected.",
-        "introduced": "0.1.4",
+        "name": "PublicLibFunctionsDoNotReturnNestedArrays",
+        "summary": "Calls to public library functions (internal functions are safe) that return nested arrays return only zeroes.",
+        "description": "The compiler does not complain about public library functions (internal functions are safe) returning nested arrays, but it also does not return it correctly. Thus, the function caller receives only zeroes.",
+        "introduced": "0.4.11",
         "fixed": "0.4.22",
-        "severity": "medium",
-        "check": {"regex-source": "returns[^;{]*\\[\\s*[^\\] \\t\\r\\n\\v\\f][^\\]]*\\]\\s*\\[\\s*[^\\] \\t\\r\\n\\v\\f][^\\]]*\\][^{;]*[;{]"}
+        "severity": "low"
     },
     {
         "name": "OneOfTwoConstructorsSkipped",
@@ -33,6 +32,15 @@
         "fixed": "0.4.23",
         "severity": "very low"
     },
+	{
+		"name": "NestedArrayFunctionCallDecoder",
+		"summary": "Calling functions that return multi-dimensional fixed-size arrays can result in memory corruption.",
+		"description": "If Solidity code calls a function that returns a multi-dimensional fixed-size array, array elements are incorrectly interpreted as memory pointers and thus can cause memory corruption if the return values are accessed. Calling functions with multi-dimensional fixed-size arrays is unaffected as is returning fixed-size arrays from function calls. The regular expression only checks if such functions are present, not if they are called, which is required for the contract to be affected.",
+		"introduced": "0.1.4",
+		"fixed": "0.4.22",
+		"severity": "medium",
+		"check": {"regex-source": "returns[^;{]*\\[\\s*[^\\] \\t\\r\\n\\v\\f][^\\]]*\\]\\s*\\[\\s*[^\\] \\t\\r\\n\\v\\f][^\\]]*\\][^{;]*[;{]"}
+	},
     {
         "name": "ZeroFunctionSelector",
         "summary": "It is possible to craft the name of a function such that it is executed instead of the fallback function in very specific circumstances.",
diff --git a/docs/bugs.rst b/docs/bugs.rst
index f7522183..8e3382c8 100644
--- a/docs/bugs.rst
+++ b/docs/bugs.rst
@@ -57,14 +57,15 @@ conditions
     means that the optimizer has to be switched on to enable the bug.
     If no conditions are given, assume that the bug is present.
 check
-    This field contains different checks that report whether the smart contract
+    This field contains different checks that can be used to determine
+    whether a smart contract
     contains the bug or not. The first type of check are Javascript regular
-    expressions that are to be matched against the source code ("source-regex")
-    if the bug is present.  If there is no match, then the bug is very likely
+    expressions that are to be matched against the source code ("source-regex").
+    If there is no match, then the bug is very likely
     not present. If there is a match, the bug might be present.  For improved
     accuracy, the checks should be applied to the source code after stripping
     comments.
-    The second type of check are patterns to be checked on the compact AST of
+    The second type of check are patterns to be applied to the compact AST of
     the Solidity program ("ast-compact-json-path"). The specified search query
     is a `JsonPath <https://github.com/json-path/JsonPath>`_ expression.
     If at least one path of the Solidity AST matches the query, the bug is
diff --git a/docs/bugs_by_version.json b/docs/bugs_by_version.json
index 88a480b2..90879db9 100644
--- a/docs/bugs_by_version.json
+++ b/docs/bugs_by_version.json
@@ -384,6 +384,7 @@
     "0.4.11": {
         "bugs": [
             "ExpExponentCleanup", 
+            "PublicLibFunctionsDoNotReturnNestedArrays", 
             "NestedArrayFunctionCallDecoder", 
             "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
@@ -395,6 +396,7 @@
     "0.4.12": {
         "bugs": [
             "ExpExponentCleanup", 
+            "PublicLibFunctionsDoNotReturnNestedArrays", 
             "NestedArrayFunctionCallDecoder", 
             "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
@@ -405,6 +407,7 @@
     "0.4.13": {
         "bugs": [
             "ExpExponentCleanup", 
+            "PublicLibFunctionsDoNotReturnNestedArrays", 
             "NestedArrayFunctionCallDecoder", 
             "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
@@ -415,6 +418,7 @@
     "0.4.14": {
         "bugs": [
             "ExpExponentCleanup", 
+            "PublicLibFunctionsDoNotReturnNestedArrays", 
             "NestedArrayFunctionCallDecoder", 
             "ZeroFunctionSelector", 
             "DelegateCallReturnValue"
@@ -424,6 +428,7 @@
     "0.4.15": {
         "bugs": [
             "ExpExponentCleanup", 
+            "PublicLibFunctionsDoNotReturnNestedArrays", 
             "NestedArrayFunctionCallDecoder", 
             "ZeroFunctionSelector"
         ], 
@@ -432,6 +437,7 @@
     "0.4.16": {
         "bugs": [
             "ExpExponentCleanup", 
+            "PublicLibFunctionsDoNotReturnNestedArrays", 
             "NestedArrayFunctionCallDecoder", 
             "ZeroFunctionSelector"
         ], 
@@ -441,6 +447,7 @@
         "bugs": [
             "ExpExponentCleanup", 
             "EventStructWrongData", 
+            "PublicLibFunctionsDoNotReturnNestedArrays", 
             "NestedArrayFunctionCallDecoder", 
             "ZeroFunctionSelector"
         ], 
@@ -450,6 +457,7 @@
         "bugs": [
             "ExpExponentCleanup", 
             "EventStructWrongData", 
+            "PublicLibFunctionsDoNotReturnNestedArrays", 
             "NestedArrayFunctionCallDecoder"
         ], 
         "released": "2017-10-18"
@@ -458,6 +466,7 @@
         "bugs": [
             "ExpExponentCleanup", 
             "EventStructWrongData", 
+            "PublicLibFunctionsDoNotReturnNestedArrays", 
             "NestedArrayFunctionCallDecoder"
         ], 
         "released": "2017-11-30"
@@ -481,6 +490,7 @@
         "bugs": [
             "ExpExponentCleanup", 
             "EventStructWrongData", 
+            "PublicLibFunctionsDoNotReturnNestedArrays", 
             "NestedArrayFunctionCallDecoder"
         ], 
         "released": "2018-02-14"
@@ -489,6 +499,7 @@
         "bugs": [
             "ExpExponentCleanup", 
             "EventStructWrongData", 
+            "PublicLibFunctionsDoNotReturnNestedArrays", 
             "NestedArrayFunctionCallDecoder"
         ], 
         "released": "2018-03-07"