certusone
/
cosmos-sdk
mirror of https://github.com/certusone/cosmos-sdk.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

types: make NewDecFromStr returns error for too large decimal (#9157) 

Otherwise, NewDecFromStr may accept very large input, causing Dec
methods panic, e.g Dec.TruncateInt

Found by oss-fuzz: https://oss-fuzz.com/testcase-detail/6454129938530304

Fixes #9160
This commit is contained in:
Cuong Manh Le 2021-04-22 17:21:27 +07:00 committed by GitHub
parent 1a15412b92
commit e28271b8e6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
types/decimal.go
View File

@ -177,6 +177,9 @@ func NewDecFromStr(str string) (Dec, error) {
if !ok {
return Dec{}, fmt.Errorf("failed to set decimal string: %s", combinedStr)
}
if combined.BitLen() > maxBitLen {
return Dec{}, fmt.Errorf("decimal out of range; bitLen: got %d, max %d", combined.BitLen(), maxBitLen)
}
if neg {
combined = new(big.Int).Neg(combined)
}

3
types/decimal_test.go
View File

@ -8,7 +8,7 @@ import (
"testing"
"github.com/stretchr/testify/suite"
yaml "gopkg.in/yaml.v2"
"gopkg.in/yaml.v2"
sdk "github.com/cosmos/cosmos-sdk/types"
)
@ -57,6 +57,7 @@ func (s *decimalTestSuite) TestNewDecFromStr() {
{"foobar", true, sdk.Dec{}},
{"0.foobar", true, sdk.Dec{}},
{"0.foobar.", true, sdk.Dec{}},
{"88888888888888888888888888888888888888888888888888888888888888888888844444440", true, sdk.Dec{}},
}
for tcIndex, tc := range tests {