-
Notifications
You must be signed in to change notification settings - Fork 3.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
x/bank/types: fix AddressFromBalancesStore address length overflow #9112
x/bank/types: fix AddressFromBalancesStore address length overflow #9112
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, thank you @cuonglm! Kindly cc-ing @alessio @marbar3778
Codecov Report
@@ Coverage Diff @@
## master #9112 +/- ##
=======================================
Coverage 58.79% 58.79%
=======================================
Files 583 583
Lines 32750 32750
=======================================
Hits 19255 19255
Misses 11218 11218
Partials 2277 2277
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
utACk
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
thanks for the fix. left 2 suggestions.
Thank you for the reviews @marbar3778 and @robert-zaremba! Thank you for the catch and for the PR @cuonglm! |
Description
addrLen is encoded in a byte, so it's an uint8. The code in
AddressFromBalancesStore cast it to int for bound checking, but wrongly
use "addrLen+1", which can be overflow.
To fix this, just cast addrLen once and use it in all places.
Found by fuzzing added in #9060.
Fixes #9111
Before we can merge this PR, please make sure that all the following items have been
checked off. If any of the checklist items are not applicable, please leave them but
write a little note why.
docs/
) or specification (x/<module>/spec/
)godoc
comments.Unreleased
section inCHANGELOG.md
Files changed
in the Github PR explorerCodecov Report
in the comment section below once CI passes