x/bank/types: AddressFromBalancesStore is susceptible to bounds crashes if fed an empty byte sequence or one with a false length

[odeke-em]

Summary of Bug

Coming here from fuzzing by my colleague @cuonglm who found a vector #9060
in which AddressFromBalancesStore naively just tries to slice values without bounds checking. If we look at the code

cosmos-sdk/x/bank/types/key.go

Lines 40 to 45 in 29ff333

	func AddressFromBalancesStore(key []byte) sdk.AccAddress {
	addrLen := key[0]
	addr := key[1 : addrLen+1]
	return sdk.AccAddress(addr)
	}

There are 2 problems:
a) If an empty byte sequence is passed it, it crashes
b) If I lie about the length of that sequence, we'll get a panic say with

_ = banktypes.AddressFromBalancesStore([]byte{0x7f, 0x10, 0x12, 0x74})

The second form is most dangerous because on a quick audit of data flowing through, if at all a len(...) check were made or examining what's retrieved from genesis files, it would look okay but really it is deceptive about the length of the slice hence would crash

Version

All versions

Steps to Reproduce

_ = banktypes.AddressFromBalancesStore([]byte{0x7f, 0x10, 0x12, 0x74})
_ = banktypes.AddressFromBalancesStore(nil)
_ = banktypes.AddressFromBalancesStore([]byte{})

I kindly request that we backport the fix for it.

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned