[Fix]: integer overflow in JumpTable.SubStr

.gitignore

@@ -257,3 +257,7 @@ paket-files/
 PublishProfiles
 /.vscode
 launchSettings.json
+
+# UT coverage report
+/coverages
+**/.DS_Store

src/Neo.VM/JumpTable/JumpTable.Splice.cs

@@ -95,13 +95,22 @@ public virtual void SubStr(ExecutionEngine engine, Instruction instruction)
         {
             int count = (int)engine.Pop().GetInteger();
             if (count < 0)
-                throw new InvalidOperationException($"The value {count} is out of range.");
+                throw new InvalidOperationException($"The value of count {count} is out of range.");
+
             int index = (int)engine.Pop().GetInteger();
             if (index < 0)
-                throw new InvalidOperationException($"The value {index} is out of range.");
+                throw new InvalidOperationException($"The value of index {index} is out of range.");
+
             var x = engine.Pop().GetSpan();
-            if (index + count > x.Length)
-                throw new InvalidOperationException($"The value {count} is out of range.");
+            if (count > x.Length)
+                throw new InvalidOperationException($"The value of count {count} is out of range.");
+
+            if (index >= x.Length)
+                throw new InvalidOperationException($"The value of index {index} is out of range.");
+
+            if (checked(index + count) > x.Length)
+                throw new InvalidOperationException($"The value of index + count {index + count} is out of range.");
+
             Types.Buffer result = new(count, false);
             x.Slice(index, count).CopyTo(result.InnerBuffer.Span);
             engine.Push(result);

tests/Neo.VM.Tests/Tests/OpCodes/Splice/SUBSTR.json

@@ -473,6 +473,50 @@
           }
         }
       ]
+    },
+    {
+      "name": "Count Exceed Range Test",
+      "script": [
+        "PUSHDATA1",
+        "0x0a",
+        "0x00010203040506070809",
+        "PUSH2",
+        "PUSHINT32",
+        "0x7FFFFFFF",
+        "SUBSTR"
+      ],
+      "steps": [
+        {
+          "actions": [
+            "execute"
+          ],
+          "result": {
+            "state": "FAULT"
+          }
+        }
+      ]
+    },
+    {
+      "name": "Index Exceed Range Test",
+      "script": [
+        "PUSHDATA1",
+        "0x0a",
+        "0x00010203040506070809",
+        "PUSHINT32",
+        "0x7FFFFFFF",
+        "PUSH2",
+        "SUBSTR"
+      ],
+      "steps": [
+        {
+          "actions": [
+            "execute"
+          ],
+          "result": {
+            "state": "FAULT"
+          }
+        }
+      ]
     }
   ]
 }