Repository: bitcoin/bitcoin (language: cpp)

Issue:
feefrac_mul_div: Integer-overflow in FeeFrac::Div
https://issues.oss-fuzz.com/issues/411172125:

```
echo '//v////7/////f////////8=' | base64 --decode > /tmp/dat

UBSAN_OPTIONS="suppressions=$(pwd)/test/sanitizer_suppressions/ubsan:print_stacktrace=1:halt_on_error=1:report_error_type=1" FUZZ=feefrac_mul_div  ./bld-cmake/bin/fuzz /tmp/dat
```

```
src/util/feefrac.h:99:21: runtime error: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'int64_t' (aka 'long')


Discussion / hints:

Fix patch:
diff --git a/src/util/feefrac.h b/src/util/feefrac.h
index 189fcaeae2931..c29dabc43b46f 100644
--- a/src/util/feefrac.h
+++ b/src/util/feefrac.h
@@ -96,7 +96,7 @@ struct FeeFrac
         int64_t quot = n / d;
         int32_t mod = n % d;
         // Correct result if the / operator above rounded in the wrong direction.
-        return quot + (mod > 0) - (mod && round_down);
+        return quot + ((mod > 0) - (mod && round_down));
     }
 #else
     static constexpr auto Mul = MulFallback;


Test patch:
diff --git a/src/test/feefrac_tests.cpp b/src/test/feefrac_tests.cpp
index 8da79c20718ca..ff95fc9efb880 100644
--- a/src/test/feefrac_tests.cpp
+++ b/src/test/feefrac_tests.cpp
@@ -148,6 +148,8 @@ BOOST_AUTO_TEST_CASE(feefrac_operators)
     FeeFrac max_fee2{1, 1};
     BOOST_CHECK(max_fee >= max_fee2);
 
+    // Test for integer overflow issue (https://github.com/bitcoin/bitcoin/issues/32294)
+    BOOST_CHECK_EQUAL((FeeFrac{0x7ffffffdfffffffb, 0x7ffffffd}.EvaluateFeeDown(0x7fffffff)), 0x7fffffffffffffff);
 }
 
 BOOST_AUTO_TEST_SUITE_END()