x/gov/client/cli: integer overflow from ignoring output of strconv.Atoi

[odeke-em]

Summary of Bug

Reported by cosmos/gosec in https://github.com/cosmos/cosmos-sdk/security/code-scanning/5730; on further inspection it does indeed turn out to be a bug as an overflow per this repro

package cli_test

import (
	"io"
	"strings"
	"testing"

	"github.com/chzyer/readline"
	"github.com/stretchr/testify/assert"

	"github.com/cosmos/cosmos-sdk/x/gov/client/cli"
)

type st struct {
	ToOverflow int
}

func TestPromptOverflow(t *testing.T) {
	origStdin := readline.Stdin
	defer func() {
		// Restore what .Stdin was before.
		readline.Stdin = origStdin
	}()
	// Intentionally sending a value out of the range of
	intOverflowers := []string{
		"-9223372036854775809",
		"9223372036854775808",
		"9923372036854775809",
		"-9923372036854775809",
		"18446744073709551616",
		"-18446744073709551616",
	}

	for _, intOverflower := range intOverflowers {
		overflowStr := intOverflower
		t.Run(overflowStr, func(t *testing.T) {
			sr := strings.NewReader(overflowStr + "\n")
			readline.Stdin = io.NopCloser(sr)

			v, err := cli.Prompt(st{}, "")
			assert.NotNil(t, err, "expected a report of an overflow")
			assert.Equal(t, st{}, v, "expected a value of zero")
		})
	}
}

Version

79f277c

Fix

diff --git a/x/gov/client/cli/prompt.go b/x/gov/client/cli/prompt.go
index b997f5a4a..faf7d352e 100644
--- a/x/gov/client/cli/prompt.go
+++ b/x/gov/client/cli/prompt.go
@@ -94,7 +94,16 @@ func Prompt[T any](data T, namePrefix string) (T, error) {
 		case reflect.String:
 			v.Field(i).SetString(result)
 		case reflect.Int:
-			resultInt, _ := strconv.Atoi(result)
+			resultInt, err := strconv.Atoi(result)
+			if err != nil {
+				return data, fmt.Errorf("invalid value for int: %w", err)
+			}
+			// If a value was successfully parsed the ranges of:
+			//      [minInt,     maxInt]
+			// are within the ranges of:
+			//      [minInt64, maxInt64]
+			// of which on 64-bit machines, which are most common,
+			// int==int64
 			v.Field(i).SetInt(int64(resultInt))
 		default:
 			// skip other types