fix(overflow): Fix integer overflows in BinaryEncoding and Pactus

[satoshiotomakan]

This pull request addresses error handling and input validation in serialization and deserialization logic for both Rust and C++ components. The main focus is on preventing invalid or unsafe operations when dealing with potentially problematic input data.

Rust amount encoding improvements:

• Improved error handling in the Amount struct's encode method by explicitly checking for conversion errors when casting from i64 to usize, and returning an appropriate error if the value is negative or out of range.

C++ string decoding validation:

• Enhanced bounds checking in the decodeString function to prevent buffer overflows by ensuring that the input data is large enough before attempting to read the requested number of bytes.

[Copilot]

Pull request overview

This pull request addresses integer overflow vulnerabilities in serialization/deserialization code for both C++ and Rust components. The changes focus on preventing unsafe operations when handling potentially malicious or invalid input data.

• Adds overflow protection in C++ decodeString function to prevent buffer overflow when indexInOut + len would overflow
• Implements error handling in Rust Amount::encode to reject negative values during i64 to usize conversion

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/BinaryCoding.cpp	Adds overflow check to prevent integer overflow when calculating buffer bounds in decodeString
rust/chains/tw_pactus/src/types/amount.rs	Adds explicit error handling for negative amounts in encode method using try_into()

Comments suppressed due to low confidence (1)

rust/chains/tw_pactus/src/types/amount.rs:21

• The encoded_size method still uses an unsafe cast from i64 to usize on line 20, which can cause integer overflow for negative values. This is inconsistent with the overflow protection added to the encode method. Consider using try_into() here as well and handling negative values appropriately. Since encoded_size returns usize, you could either return 0 for negative values, or use saturating_abs() to get the absolute value before casting.

    fn encoded_size(&self) -> usize {
        VarInt::from(self.0 as usize).encoded_size()
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Binary size comparison

➡️ aarch64-apple-ios: 14.31 MB

➡️ aarch64-apple-ios-sim: 14.31 MB

➡️ aarch64-linux-android: 18.87 MB

➡️ armv7-linux-androideabi: 15.80 MB

➡️ wasm32-unknown-emscripten: 13.46 MB