Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/bank/types: fix AddressFromBalancesStore address length overflow #9112

Merged
merged 2 commits into from
Apr 15, 2021
Merged

x/bank/types: fix AddressFromBalancesStore address length overflow #9112

merged 2 commits into from
Apr 15, 2021

Conversation

cuonglm
Copy link
Contributor

@cuonglm cuonglm commented Apr 14, 2021

Description

addrLen is encoded in a byte, so it's an uint8. The code in
AddressFromBalancesStore cast it to int for bound checking, but wrongly
use "addrLen+1", which can be overflow.

To fix this, just cast addrLen once and use it in all places.

Found by fuzzing added in #9060.

Fixes #9111


Before we can merge this PR, please make sure that all the following items have been
checked off. If any of the checklist items are not applicable, please leave them but
write a little note why.

  • Targeted PR against correct branch (see CONTRIBUTING.md)
  • Linked to Github issue with discussion and accepted design OR link to spec that describes this work.
  • Code follows the module structure standards.
  • Wrote unit and integration tests
  • Updated relevant documentation (docs/) or specification (x/<module>/spec/)
  • Added relevant godoc comments.
  • Added a relevant changelog entry to the Unreleased section in CHANGELOG.md
  • Re-reviewed Files changed in the Github PR explorer
  • Review Codecov Report in the comment section below once CI passes

Copy link
Collaborator

@odeke-em odeke-em left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thank you @cuonglm! Kindly cc-ing @alessio @marbar3778

@codecov
Copy link

codecov bot commented Apr 14, 2021

Codecov Report

Merging #9112 (3d039e0) into master (a4a6e05) will not change coverage.
The diff coverage is 100.00%.

Impacted file tree graph

@@           Coverage Diff           @@
##           master    #9112   +/-   ##
=======================================
  Coverage   58.79%   58.79%           
=======================================
  Files         583      583           
  Lines       32750    32750           
=======================================
  Hits        19255    19255           
  Misses      11218    11218           
  Partials     2277     2277           
Impacted Files Coverage Δ
x/bank/types/key.go 80.00% <100.00%> (ø)

Copy link
Member

@tac0turtle tac0turtle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

utACk

Copy link
Collaborator

@robert-zaremba robert-zaremba left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for the fix. left 2 suggestions.

x/bank/types/key.go Outdated Show resolved Hide resolved
x/bank/types/key.go Outdated Show resolved Hide resolved
addrLen is encoded in a byte, so it's an uint8. The code in
AddressFromBalancesStore cast it to int for bound checking, but wrongly
use "addrLen+1", which can be overflow.

To fix this, just cast addrLen once and use it in all places.

Found by fuzzing added in #9060.

Fixes #9111
@odeke-em
Copy link
Collaborator

Thank you for the reviews @marbar3778 and @robert-zaremba! Thank you for the catch and for the PR @cuonglm!

@odeke-em odeke-em merged commit ef69863 into cosmos:master Apr 15, 2021
@odeke-em odeke-em deleted the cuonglm/fix-x-bank-types-AddressFromBalancesStore-2 branch April 15, 2021 07:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

x/bank/types: AddressFromBalancesStore address length checking condition false positive
4 participants