[Fix]: integer overflow in JumpTable.SubStr

.gitignore

@@ -260,5 +260,9 @@ launchSettings.json
 /coverages
 **/.DS_Store
 
+# UT coverage report
+/coverages
+**/.DS_Store
+
 # Benchmarks
 **/BenchmarkDotNet.Artifacts/

src/Neo.VM/JumpTable/JumpTable.Splice.cs

@@ -101,7 +101,7 @@ public virtual void SubStr(ExecutionEngine engine, Instruction instruction)
             if (index < 0)
                 throw new InvalidOperationException($"The index can not be negative for {nameof(OpCode.SUBSTR)}, index: {index}.");
             var x = engine.Pop().GetSpan();
-            if (index + count > x.Length)
+            if (checked(index + count) > x.Length)
                 throw new InvalidOperationException($"The index + count is out of range for {nameof(OpCode.SUBSTR)}, index: {index}, count: {count}, {index + count}/[0, {x.Length}].");
             Types.Buffer result = new(count, false);
             x.Slice(index, count).CopyTo(result.InnerBuffer.Span);

tests/Neo.VM.Tests/Tests/OpCodes/Splice/SUBSTR.json

@@ -473,6 +473,50 @@
           }
         }
       ]
+    },
+    {
+      "name": "Count Exceed Range Test",
+      "script": [
+        "PUSHDATA1",
+        "0x0a",
+        "0x00010203040506070809",
+        "PUSH2",
+        "PUSHINT32",
+        "0x7FFFFFFF",
+        "SUBSTR"
+      ],
+      "steps": [
+        {
+          "actions": [
+            "execute"
+          ],
+          "result": {
+            "state": "FAULT"
+          }
+        }
+      ]
+    },
+    {
+      "name": "Index Exceed Range Test",
+      "script": [
+        "PUSHDATA1",
+        "0x0a",
+        "0x00010203040506070809",
+        "PUSHINT32",
+        "0x7FFFFFFF",
+        "PUSH2",
+        "SUBSTR"
+      ],
+      "steps": [
+        {
+          "actions": [
+            "execute"
+          ],
+          "result": {
+            "state": "FAULT"
+          }
+        }
+      ]
     }
   ]
 }