Unbounded array/list type sizes trigger excessive memory allocation

[Sahilgill24]

Project version

0.7.2

Project

compiler

What happened?

A type annotation with a huge array size or list bound, leads to the compiler allocating a Vec proportional to that size without any cap.

// src/types.rs:1246
let elements = vec![element; size];               // eager alloc of `size` items
// src/types.rs:1253
let el_vector = vec![element.0; bound.get() - 1];  // eager alloc of bound-1 items

StructuralType::from() runs for every type during ordinary compilation (type unification in SingleExpression::compile), so merely using the type reaches this without any literal being needed.

An oversized bound causes the compiler to panic, and a mid sized size/bound could lead to multi GB allocation resulting in OOM. This means anything that compiles .simf could be lead to a trivial DoS.

Minimal reproduction steps

fn main() {
    let _x: List<u8, 4611686018427387904> = witness::W;
}

run this file using simc leads to a capacity overflow panic and here I have used a size large enough (2^62, but a mid size could eat up all the RAM of a device)

the error

thread 'main' (5514237) panicked at /rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library/alloc/src/raw_vec/mod.rs:28:5:
capacity overflow