From e6b8aed7ac3bf89f78a6451bf516196737eab584 Mon Sep 17 00:00:00 2001
From: Kartik Bhat <kartikbhatri@gmail.com>
Date: Fri, 12 Jul 2024 12:33:07 -0400
Subject: [PATCH] Add Gas Overflow Check (#1753)

* Add Overflow Check

* Add unit tests
---
 app/app.go      |  9 ++++++++-
 app/app_test.go | 28 ++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/app/app.go b/app/app.go
index 4b25a4f198..efd2b6ca7a 100644
--- a/app/app.go
+++ b/app/app.go
@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"math"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -1844,7 +1845,13 @@ func (app *App) checkTotalBlockGasWanted(ctx sdk.Context, txs [][]byte) bool {
 		if isGasless {
 			continue
 		}
-		totalGasWanted += feeTx.GetGas()
+		// Check for overflow before adding
+		gasWanted := feeTx.GetGas()
+		if int64(gasWanted) < 0 || int64(totalGasWanted) > math.MaxInt64-int64(gasWanted) {
+			return false
+		}
+
+		totalGasWanted += gasWanted
 		if totalGasWanted > uint64(ctx.ConsensusParams().Block.MaxGas) {
 			// early return
 			return false
diff --git a/app/app_test.go b/app/app_test.go
index d486ff30e8..d4944acd76 100644
--- a/app/app_test.go
+++ b/app/app_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/hex"
 	"fmt"
+	"math"
 	"math/big"
 	"reflect"
 	"testing"
@@ -311,6 +312,33 @@ func TestInvalidProposalWithExcessiveGasWanted(t *testing.T) {
 	require.Equal(t, abci.ResponseProcessProposal_REJECT, res.Status)
 }
 
+func TestOverflowGas(t *testing.T) {
+	tm := time.Now().UTC()
+	valPub := secp256k1.GenPrivKey().PubKey()
+
+	testWrapper := app.NewTestWrapper(t, tm, valPub, false)
+	ap := testWrapper.App
+	ctx := testWrapper.Ctx.WithConsensusParams(&types.ConsensusParams{
+		Block: &types.BlockParams{MaxGas: math.MaxInt64},
+	})
+	emptyTxBuilder := app.MakeEncodingConfig().TxConfig.NewTxBuilder()
+	txEncoder := app.MakeEncodingConfig().TxConfig.TxEncoder()
+	emptyTxBuilder.SetGasLimit(uint64(math.MaxInt64))
+	emptyTx, _ := txEncoder(emptyTxBuilder.GetTx())
+
+	secondEmptyTxBuilder := app.MakeEncodingConfig().TxConfig.NewTxBuilder()
+	secondEmptyTxBuilder.SetGasLimit(10)
+	secondTx, _ := txEncoder(secondEmptyTxBuilder.GetTx())
+
+	proposal := abci.RequestProcessProposal{
+		Txs:    [][]byte{emptyTx, secondTx},
+		Height: 1,
+	}
+	res, err := ap.ProcessProposalHandler(ctx, &proposal)
+	require.Nil(t, err)
+	require.Equal(t, abci.ResponseProcessProposal_REJECT, res.Status)
+}
+
 func TestDecodeTransactionsConcurrently(t *testing.T) {
 	tm := time.Now().UTC()
 	valPub := secp256k1.GenPrivKey().PubKey()