fix(baseapp): ensure finalize block response is not empty #23879
Conversation
in the defer check of FinalizeBlock to avoid panic by nil pointer
📝 WalkthroughWalkthroughThis pull request addresses a security vulnerability in the IBC module by updating the Changes
Sequence Diagram(s)sequenceDiagram
participant BA as BaseApp
participant Resp as Response
participant SS as StreamingService
%% Execution of FinalizeBlock
BA->>BA: FinalizeBlock() invoked
BA->>Resp: Check if response exists
alt Response is nil
BA-->>BA: Return early (skip streaming hooks)
else Response is valid
BA->>SS: Execute streaming service hooks
end
Possibly related PRs
Suggested labels
Suggested reviewers
✨ Finishing Touches
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| // where they adhere to the sdk.Tx interface. | ||
| func (app *BaseApp) FinalizeBlock(req *abci.FinalizeBlockRequest) (res *abci.FinalizeBlockResponse, err error) { | ||
| defer func() { | ||
| if res == nil { | ||
| return | ||
| } | ||
| // call the streaming service hooks with the FinalizeBlock messages |
There was a problem hiding this comment.
Change potentially affects state.
Call sequence:
(*github.com/cosmos/cosmos-sdk/baseapp.BaseApp).FinalizeBlock (baseapp/abci.go:904)
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: .coderabbit.yml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
CHANGELOG.md(1 hunks)baseapp/abci.go(1 hunks)
🧰 Additional context used
📓 Path-based instructions (2)
`**/*.go`: Review the Golang code for conformity with the Ub...
**/*.go: Review the Golang code for conformity with the Uber Golang style guide, highlighting any deviations.
baseapp/abci.go
`**/*.md`: "Assess the documentation for misspellings, gramm...
**/*.md: "Assess the documentation for misspellings, grammatical errors, missing documentation and correctness"
CHANGELOG.md
⏰ Context from checks skipped due to timeout of 90000ms (5)
- GitHub Check: tests (01)
- GitHub Check: tests (00)
- GitHub Check: test-system-v2
- GitHub Check: Analyze
- GitHub Check: Summary
🔇 Additional comments (1)
CHANGELOG.md (1)
56-56: Clear and concise bug fix description that follows the standard format.The changelog entry accurately describes the bug fix to prevent a panic from a nil pointer in the
FinalizeBlockdefer check. This is appropriately categorized under the Bug Fixes section and follows the established pattern for changelog entries.
| if res == nil { | ||
| return | ||
| } |
There was a problem hiding this comment.
Important safety check to prevent nil pointer dereference.
The added check prevents a panic that would occur if res is nil when executing the streaming service hooks. Without this check, dereferencing *res in the ListenFinalizeBlock call would cause a runtime crash.
|
thanks @mmsqe! do you think we could test this behavior? |
in the defer check of FinalizeBlock to avoid panic by nil pointer
Description
Closes: #XXXX
Author Checklist
All items are required. Please add a note to the item if the item is not applicable and
please add links to any relevant follow up issues.
I have...
!in the type prefix if API or client breaking changeCHANGELOG.mdReviewers Checklist
All items are required. Please add a note if the item is not applicable and please add
your handle next to the items reviewed if you only reviewed selected items.
Please see Pull Request Reviewer section in the contributing guide for more information on how to review a pull request.
I have...
Summary by CodeRabbit