fix[codegen]: fix _abi_decode buffer overflow

tests/functional/builtins/codegen/test_abi_decode.py

@@ -467,3 +467,24 @@ def foo(x: Bytes[32]):
 @pytest.mark.parametrize("bad_code,exception", FAIL_LIST)
 def test_abi_decode_length_mismatch(get_contract, assert_compile_failed, bad_code, exception):
     assert_compile_failed(lambda: get_contract(bad_code), exception)
+
+
+def test_abi_decode_overflow(w3, tx_failed, get_contract):
+    # test based on GHSA-9p8r-4xp4-gw5w: https://github.com/vyperlang/vyper/security/advisories/GHSA-9p8r-4xp4-gw5w#advisory-comment-91841
+    # note: doesn't even reach the assert but reverts internally on the clamp in getelemptr
+    code = """
+@external
+def f(x: Bytes[32 * 3]):
+    a: Bytes[32] = b"foo"
+    y: Bytes[32 * 3] = x
+
+    decoded_y1: Bytes[32] = _abi_decode(y, Bytes[32])
+    a = b"bar"
+    decoded_y2: Bytes[32] = _abi_decode(y, Bytes[32])
+
+    assert decoded_y1 != decoded_y2
+    """
+    c = get_contract(code)
+    data = "d45754f800000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000060ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa0"
+    with tx_failed():
+        w3.eth.send_transaction({"to": c.address, "data": data})

vyper/codegen/core.py

@@ -445,8 +445,9 @@ def _mul(x, y):
 
 
 # Resolve pointer locations for ABI-encoded data
-def _getelemptr_abi_helper(parent, member_t, ofst, clamp=True):
+def _getelemptr_abi_helper(parent, member_t, ofst, clamp_=True):
     member_abi_t = member_t.abi_type
+    parent_abi_t = parent.typ.abi_type
 
     # ABI encoding has length word and then pretends length is not there
     # e.g. [[1,2]] is encoded as 0x01 <len> 0x20 <inner array ofst> <encode(inner array)>
@@ -457,11 +458,17 @@ def _getelemptr_abi_helper(parent, member_t, ofst, clamp=True):
     ofst_ir = add_ofst(parent, ofst)
 
     if member_abi_t.is_dynamic():
+        abi_ofst = unwrap_location(ofst_ir)
         # double dereference, according to ABI spec
         # TODO optimize special case: first dynamic item
         # offset is statically known.
         ofst_ir = add_ofst(parent, unwrap_location(ofst_ir))
 
+        if parent.location == MEMORY:  # TODO: replace with utility function
+            bound = parent_abi_t.size_bound()
+            abi_ofst = clamp("le", abi_ofst, bound)
+            ofst_ir = add_ofst(parent, abi_ofst)
+
     return IRnode.from_list(
         ofst_ir,
         typ=member_t,