x/bank/types: AddressFromBalancesStore address length checking condition false positive

[cuonglm]

Summary of Bug

Coming here from #9060, the current address length checking condition in AddressFromBalancesStore has false positive:

cosmos-sdk/x/bank/types/key.go

Line 47 in 849fab1

if len(key[1:]) < int(addrLen) {

First, we check for len(key[1:]) < int(addrLen), but later, we do slice slicing with key[1 : addrLen+1].

The problem is that addrLen is encoded in a byte, so addrLen+1 can be overflow. It seems to me that we can fix this by using `int(addrLen)+1 instead.

Version

All versions.

Steps to Reproduce

_ = banktypes.AddressFromBalancesStore([]byte("\xff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned

[cuonglm]

cc @odeke-em

[odeke-em]

Nice catch @cuonglm and good to see that a fuzzer also caught it! Please help send a PR for it. Thank you!

[cuonglm]

Nice catch @cuonglm and good to see that a fuzzer also caught it! Please help send a PR for it. Thank you!

Added in #9112