Nil pointer dereference in gossipVotesRoutine (v0.6.7)

[joe-hellomoon]

Bug Description

gossipVotesRoutine in v0.6.7 can panic with a nil pointer dereference when LoadBlockCommit returns nil during peer catchup.

Affected Version

• sei-tendermint v0.6.7 (used by sei-chain v6.2.2)

Stack Trace

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x50 pc=0x18b6d87]
goroutine 785554944 [running]:
github.com/tendermint/tendermint/types.(*Commit).WrappedExtendedCommit(...)
        /home/ubuntu/go/pkg/mod/github.com/sei-protocol/sei-tendermint@v0.6.7/types/block.go:964
github.com/tendermint/tendermint/internal/consensus.(*Reactor).gossipVotesRoutine(...)
        /home/ubuntu/go/pkg/mod/github.com/sei-protocol/sei-tendermint@v0.6.7/internal/consensus/reactor.go:802

Root Cause

In internal/consensus/reactor.go:802:

ec = r.state.blockStore.LoadBlockCommit(prs.Height).WrappedExtendedCommit()

LoadBlockCommit can return nil (race condition during peer catchup), but .WrappedExtendedCommit() is called without a nil check.

Note

This issue is already fixed in main/v0.6.5 where vote extensions were removed entirely (#312). The issue only affects v0.6.7 which is on a separate branch that kept vote extensions.

Suggested Fix

commit := r.state.blockStore.LoadBlockCommit(prs.Height)
if commit != nil {
    ec = commit.WrappedExtendedCommit()
}