fix(query): clamp offset+limit to avoid uint64 overflow (Fixes #25006)

types/query/pagination.go

@@ -55,6 +55,7 @@ func Paginate(
 	onResult func(key, value []byte) error,
 ) (*PageResponse, error) {
 	pageRequest = initPageRequestDefaults(pageRequest)
+	pageRequest = ClampPageRequestLimit(pageRequest)
 
 	if pageRequest.Offset > 0 && pageRequest.Key != nil {
 		return nil, fmt.Errorf("invalid request, either offset or key is expected, got both")
@@ -158,3 +159,16 @@ func initPageRequestDefaults(pageRequest *PageRequest) *PageRequest {
 
 	return &pageRequestCopy
 }
+
+// ClampPageRequestLimit returns a safe Limit such that Offset+Limit never overflows uint64.
+func ClampPageRequestLimit(pageRequest *PageRequest) *PageRequest {
+	if pageRequest == nil {
+		return &PageRequest{}
+	}
+
+	pageRequestCopy := *pageRequest
+	if pageRequestCopy.Limit > PaginationMaxLimit-pageRequestCopy.Offset {
+		pageRequestCopy.Limit = PaginationMaxLimit - pageRequestCopy.Offset
+	}
+	return &pageRequestCopy
+}

types/query/pagination_test.go

@@ -375,3 +375,17 @@ func (s *paginationTestSuite) TestPaginate() {
 	// Output:
 	// balances:<denom:"foo0denom" amount:"100" > pagination:<next_key:"foo1denom" total:2 >
 }
+
+func (s *paginationTestSuite) TestClampOverflow() {
+	s.T().Log("verify that Limit is clamped when Offset+Limit would overflow")
+
+	pageReq := &query.PageRequest{
+		Offset: uint64(5),
+		Limit:  ^uint64(0),
+	}
+
+	clamped := query.ClampPageRequestLimit(pageReq)
+
+	want := query.PaginationMaxLimit - clamped.Offset
+	s.Require().Equal(want, clamped.Limit)
+}