Listen to this Post
The `lastIndexOf(bytes,byte,uint256)` function in OpenZeppelin’s `Bytes.sol` library performs out-of-bounds memory access when two conditions are met:
1. The buffer length is empty (buffer.length == 0).
2. The `position` argument is not set to `2256 – 1` (pos != type(uint256).max).
In this case, the function reads memory at buffer + 0x20 + pos, which may access uninitialized or unintended memory regions. If the memory at this offset matches the search pattern, the function returns an invalid index outside the buffer bounds instead of the expected type(uint256).max.
Callers relying on this function without bounds checking may process incorrect indices, leading to unexpected reverts or undefined behavior. The vulnerability primarily affects gas usage and index validity but does not directly enable arbitrary code execution.
DailyCVE Form:
Platform: OpenZeppelin Contracts
Version: <5.4.0
Vulnerability: Out-of-bounds read
Severity: Moderate
Date: Jul 17, 2025
Prediction: Patch available (5.4.0)
What Undercode Say:
// Vulnerable function call example bytes memory buffer; uint256 pos = 0; lastIndexOf(buffer, 0x00, pos); // Fixed version (5.4.0+) import "@openzeppelin/contracts/utils/Bytes.sol";
How Exploit:
- Trigger out-of-bounds read via empty buffer + custom
pos. - Manipulate gas usage or force invalid index return.
Protection from this CVE:
- Upgrade to v5.4.0.
- Validate buffer length before calling.
Impact:
- Gas exhaustion risks.
- Invalid index processing.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
