x/bank/types: fix AddressFromBalancesStore address length overflow (#…

…9112)

addrLen is encoded in a byte, so it's an uint8. The code in
AddressFromBalancesStore cast it to int for bound checking, but wrongly uses "addrLen+1", which can be overflow.

To fix this, just cast addrLen once and use it in all places.

Found by fuzzing added in #9060.

Fixes #9111

x/bank/types/key.go

@@ -44,12 +44,11 @@ func AddressFromBalancesStore(key []byte) (sdk.AccAddress, error) {
 		return nil, ErrInvalidKey
 	}
 	addrLen := key[0]
-	if len(key[1:]) < int(addrLen) {
+	bound := int(addrLen)
+	if len(key)-1 < bound {
 		return nil, ErrInvalidKey
 	}
-	addr := key[1 : addrLen+1]
-
-	return sdk.AccAddress(addr), nil
+	return key[1 : bound+1], nil
 }
 
 // CreateAccountBalancesPrefix creates the prefix for an account's balances.

x/bank/types/key_test.go

@@ -24,29 +24,34 @@ func TestAddressFromBalancesStore(t *testing.T) {
 	require.NoError(t, err)
 	addrLen := len(addr)
 	require.Equal(t, 20, addrLen)
-
 	key := cloneAppend(address.MustLengthPrefix(addr), []byte("stake"))
-	res, err := types.AddressFromBalancesStore(key)
-	require.NoError(t, err)
-	require.Equal(t, res, addr)
-}
 
-func TestInvalidAddressFromBalancesStore(t *testing.T) {
 	tests := []struct {
-		name string
-		key  []byte
+		name        string
+		key         []byte
+		wantErr     bool
+		expectedKey sdk.AccAddress
 	}{
-		{"empty", []byte("")},
-		{"invalid", []byte("3AA")},
+		{"valid", key, false, addr},
+		{"#9111", []byte("\xff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"), false, nil},
+		{"empty", []byte(""), true, nil},
+		{"invalid", []byte("3AA"), true, nil},
 	}
 
 	for _, tc := range tests {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
-			_, err := types.AddressFromBalancesStore(tc.key)
-			assert.Error(t, err)
-			assert.True(t, errors.Is(types.ErrInvalidKey, err))
+			addr, err := types.AddressFromBalancesStore(tc.key)
+			if tc.wantErr {
+				assert.Error(t, err)
+				assert.True(t, errors.Is(types.ErrInvalidKey, err))
+			} else {
+				assert.NoError(t, err)
+			}
+			if len(tc.expectedKey) > 0 {
+				assert.Equal(t, tc.expectedKey, addr)
+			}
 		})
 	}
 }