Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rules/sdk: add check for missing .IsNil check before deference after being cast from an interface{} to avoid nil pointer dereferences #27

Open
odeke-em opened this issue Jun 10, 2022 · 1 comment
Labels
enhancement New feature or request

Comments

@odeke-em
Copy link
Collaborator

Summary

There is this cosmos-sdk bug cosmos/cosmos-sdk#5621 in which an sdk.Dec value was cast from an interface{} value, thus can be nil. We really should be able to detect objects with a .IsNil and if we didn't invoke that and invoke any other method, we should report that

Steps to reproduce the behavior

package main

import "github.com/cosmos/cosmos-sdk/types"

func main() {
	var n95 types.Dec
	_ = n95.Abs()
}
$ go run it.go 
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x10 pc=0x1713e9c]

goroutine 1 [running]:
math/big.(*Int).Set(...)
	/Users/emmanuelodeke/go/src/go.googlesource.com/go/src/math/big/int.go:74
math/big.(*Int).Abs(...)
	/Users/emmanuelodeke/go/src/go.googlesource.com/go/src/math/big/int.go:102
github.com/cosmos/cosmos-sdk/types.Dec.Abs(...)
	/Users/emmanuelodeke/go/src/github.com/cosmos/cosmos-sdk/types/decimal.go:217
main.main()
	/Users/emmanuelodeke/go/src/github.com/cosmos/cosmos-sdk/tests/nilcheck/it.go:7 +0x1c
exit status 2

Expected behavior

That code should have been flagged by gosec. Kindly cc-ing @kirbyquerby

@odeke-em
Copy link
Collaborator Author

@kirbyquerby we could even purposefully just detect the pattern where a .(types.Dec) was cast from an interface{} value and from that ensure that firstly .IsNil() was invoked.

@odeke-em odeke-em added the enhancement New feature or request label Jun 10, 2022
@odeke-em odeke-em changed the title feature: rules/sdk: add check for missing .IsNil check before deference after being cast from an interface{} to avoid nil pointer dereferences rules/sdk: add check for missing .IsNil check before deference after being cast from an interface{} to avoid nil pointer dereferences Jun 10, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant