From e592ce4f33e6b1705ba82f7772c7796f5f06df09 Mon Sep 17 00:00:00 2001
From: cdetrio <cdetrio@gmail.com>
Date: Tue, 6 Jun 2017 18:57:49 +0200
Subject: [PATCH 1/6] fix bug when a zero-value call creates a new account
 (homestead)

---
 lib/opFns.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/opFns.js b/lib/opFns.js
index 1c05f289f8..d152ea6e3d 100644
--- a/lib/opFns.js
+++ b/lib/opFns.js
@@ -555,8 +555,12 @@ module.exports = {
         return
       }
       if (!exists) {
-        // can't wrap because we are in a callback
-        runState.gasLeft.isub(new BN(fees.callNewAccountGas.v))
+        try {
+          subGas(runState, new BN(fees.callNewAccountGas.v))
+        } catch (e) {
+          done(e.error)
+          return
+        }
       }
       makeCall(runState, options, localOpts, done)
     })

From b83a92884b87a258fbe93a57feac2212a7fd231d Mon Sep 17 00:00:00 2001
From: cdetrio <cdetrio@gmail.com>
Date: Thu, 8 Jun 2017 13:08:05 +0200
Subject: [PATCH 2/6] signextend removes two stack items

---
 lib/opcodes.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/opcodes.js b/lib/opcodes.js
index 70434d8698..4c9d982abb 100644
--- a/lib/opcodes.js
+++ b/lib/opcodes.js
@@ -12,7 +12,7 @@ const codes = {
   0x08: ['ADDMOD', 8, 3, 1, false],
   0x09: ['MULMOD', 8, 3, 1, false],
   0x0a: ['EXP', 10, 2, 1, false],
-  0x0b: ['SIGNEXTEND', 5, 1, 1, false],
+  0x0b: ['SIGNEXTEND', 5, 2, 1, false],
 
   // 0x10 range - bit ops
   0x10: ['LT', 3, 2, 1, false],

From 9edd6eb3d53e8dc14e63a798006132fe107e6708 Mon Sep 17 00:00:00 2001
From: cdetrio <cdetrio@gmail.com>
Date: Thu, 8 Jun 2017 14:56:43 +0200
Subject: [PATCH 3/6] fix for stack overflow tests

---
 lib/constants.js | 1 +
 lib/runCode.js   | 7 ++++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/constants.js b/lib/constants.js
index bddb2e84d6..246f2bc796 100644
--- a/lib/constants.js
+++ b/lib/constants.js
@@ -1,6 +1,7 @@
 exports.ERROR = {
   OUT_OF_GAS: 'out of gas',
   STACK_UNDERFLOW: 'stack underflow',
+  STACK_OVERFLOW: 'stack overflow',
   INVALID_JUMP: 'invalid JUMP',
   INVALID_OPCODE: 'invalid opcode'
 }
diff --git a/lib/runCode.js b/lib/runCode.js
index b9f3ed4202..97f1c3dcdb 100644
--- a/lib/runCode.js
+++ b/lib/runCode.js
@@ -109,9 +109,6 @@ module.exports = function (opts, cb) {
   }
 
   function iterateVm (done) {
-    if (runState.stack.length > 1024) {
-      return done(ERROR.INVALID_OPCODE)
-    }
 
     var opCode = runState.code[runState.programCounter]
     var opInfo = lookupOpInfo(opCode)
@@ -131,6 +128,10 @@ module.exports = function (opts, cb) {
       return done(ERROR.STACK_UNDERFLOW)
     }
 
+    if ((runState.stack.length - opInfo.in + opInfo.out) > 1024) {
+      return done(ERROR.STACK_OVERFLOW)
+    }
+
     async.series([
       runStepHook,
       runOp

From 49f6301fa7f31c20bf34dda8fb0397d25c416d93 Mon Sep 17 00:00:00 2001
From: cdetrio <cdetrio@gmail.com>
Date: Sun, 18 Jun 2017 12:20:55 +0200
Subject: [PATCH 4/6] fix SIGNEXTEND

---
 lib/opFns.js | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/lib/opFns.js b/lib/opFns.js
index d152ea6e3d..e02e9621ee 100644
--- a/lib/opFns.js
+++ b/lib/opFns.js
@@ -131,15 +131,13 @@ module.exports = {
 
     return result
   },
-  SIGNEXTEND: function (k, runState) {
+  SIGNEXTEND: function (k, val, runState) {
     k = new BN(k)
     var extendOnes = false
 
     if (k.cmpn(31) <= 0) {
       k = k.toNumber()
 
-      var val = new Buffer(utils.setLengthLeft(runState.stack.pop(), 32))
-
       if (val[31 - k] & 0x80) {
         extendOnes = true
       }
@@ -149,8 +147,9 @@ module.exports = {
         val[i] = extendOnes ? 0xff : 0
       }
 
-      return val
     }
+
+    return val
   },
   // 0x10 range - bit ops
   LT: function (a, b, runState) {

From a90b93649ed452e24eb0eba5da28e9f4e60cbabc Mon Sep 17 00:00:00 2001
From: cdetrio <cdetrio@gmail.com>
Date: Sun, 18 Jun 2017 12:26:16 +0200
Subject: [PATCH 5/6] fix when CALL should OOG before executing

---
 lib/opFns.js | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/lib/opFns.js b/lib/opFns.js
index e02e9621ee..1c7cc8e604 100644
--- a/lib/opFns.js
+++ b/lib/opFns.js
@@ -546,13 +546,12 @@ module.exports = {
       options.gasLimit.iadd(new BN(fees.callStipend.v))
     }
 
-    checkCallMemCost(runState, options, localOpts)
-
     stateManager.exists(toAddress, function (err, exists) {
       if (err) {
         done(err)
         return
       }
+
       if (!exists) {
         try {
           subGas(runState, new BN(fees.callNewAccountGas.v))
@@ -561,6 +560,14 @@ module.exports = {
           return
         }
       }
+
+      try {
+        checkCallMemCost(runState, options, localOpts)
+      } catch (e) {
+        done(e.error)
+        return
+      }
+
       makeCall(runState, options, localOpts, done)
     })
   },

From 9e9cc018cd48df1869c6ff9778c9418c7a71eb78 Mon Sep 17 00:00:00 2001
From: cdetrio <cdetrio@gmail.com>
Date: Sun, 18 Jun 2017 16:44:26 +0200
Subject: [PATCH 6/6] yet another SIGNEXTEND fix

---
 lib/opFns.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/opFns.js b/lib/opFns.js
index 1c7cc8e604..3dd61a712f 100644
--- a/lib/opFns.js
+++ b/lib/opFns.js
@@ -133,6 +133,7 @@ module.exports = {
   },
   SIGNEXTEND: function (k, val, runState) {
     k = new BN(k)
+    val = new Buffer(val) // use clone, don't modify object reference
     var extendOnes = false
 
     if (k.cmpn(31) <= 0) {
@@ -146,7 +147,6 @@ module.exports = {
       for (var i = 30 - k; i >= 0; i--) {
         val[i] = extendOnes ? 0xff : 0
       }
-
     }
 
     return val