You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
There is this cosmos-sdk bug cosmos/cosmos-sdk#5621 in which an sdk.Dec value was cast from an interface{} value, thus can be nil. We really should be able to detect objects with a .IsNil and if we didn't invoke that and invoke any other method, we should report that
Steps to reproduce the behavior
package main
import"github.com/cosmos/cosmos-sdk/types"funcmain() {
varn95 types.Dec_=n95.Abs()
}
$ go run it.go
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x10 pc=0x1713e9c]
goroutine 1 [running]:
math/big.(*Int).Set(...)
/Users/emmanuelodeke/go/src/go.googlesource.com/go/src/math/big/int.go:74
math/big.(*Int).Abs(...)
/Users/emmanuelodeke/go/src/go.googlesource.com/go/src/math/big/int.go:102
github.com/cosmos/cosmos-sdk/types.Dec.Abs(...)
/Users/emmanuelodeke/go/src/github.com/cosmos/cosmos-sdk/types/decimal.go:217
main.main()
/Users/emmanuelodeke/go/src/github.com/cosmos/cosmos-sdk/tests/nilcheck/it.go:7 +0x1c
exit status 2
Expected behavior
That code should have been flagged by gosec. Kindly cc-ing @kirbyquerby
The text was updated successfully, but these errors were encountered:
@kirbyquerby we could even purposefully just detect the pattern where a .(types.Dec) was cast from an interface{} value and from that ensure that firstly .IsNil() was invoked.
odeke-em
changed the title
feature: rules/sdk: add check for missing .IsNil check before deference after being cast from an interface{} to avoid nil pointer dereferences
rules/sdk: add check for missing .IsNil check before deference after being cast from an interface{} to avoid nil pointer dereferences
Jun 10, 2022
Summary
There is this cosmos-sdk bug cosmos/cosmos-sdk#5621 in which an sdk.Dec value was cast from an interface{} value, thus can be nil. We really should be able to detect objects with a .IsNil and if we didn't invoke that and invoke any other method, we should report that
Steps to reproduce the behavior
Expected behavior
That code should have been flagged by gosec. Kindly cc-ing @kirbyquerby
The text was updated successfully, but these errors were encountered: