Signed integer overflow in CFeeRate::GetFee(…) reachable via RPC call analyzepsbt

[practicalswift]

While fuzzing the RPC interface I stumbled upon a signed integer overflow in CFeeRate::GetFee(…) which is reachable via the following analyzepsbt RPC call:

$ ./autogen.sh
$ CC=clang CXX=clang++ ./configure --with-sanitizers=address,undefined
$ make
$ UBSAN_OPTIONS="print_stacktrace=1" src/bitcoind &
$ src/bitcoin-cli analyzepsbt cHNidP8BABMAAAYAAAFdAAAKAAIEAAAAAAAGAAA=
policy/feerate.cpp:26:34: runtime error: signed integer overflow: -59373636730022578 * 1000 cannot be represented in type 'long'
    #0 0x55751767911b in CFeeRate::GetFee(unsigned long) const src/policy/feerate.cpp:26:34
    #1 0x557516e2e6a0 in CFeeRate::GetFeePerK() const src/./policy/feerate.h:60:41
    #2 0x557516e2e6a0 in analyzepsbt()::$_17::operator()(RPCHelpMan const&, JSONRPCRequest const&) const src/rpc/rawtransaction.cpp:1842:85
...

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior policy/feerate.cpp:26:34 in
{
  "estimated_vsize": 19,
  "estimated_feerate": -40334045.08893923,
  "fee": -11280990.97870429,
  "next": "extractor"
}

Nothing high priority of course, but still worth fixing :)

[practicalswift]

When this is fixed the following two old fuzzing workarounds for the same underlying issue can be removed too:

bitcoin/src/test/fuzz/util.h

Lines 143 to 147 in 795afe6

	// Avoid:
	// policy/feerate.cpp:28:34: runtime error: signed integer overflow: 34873208148477500 * 1000 cannot be represented in type 'long'
	//
	// Reproduce using CFeeRate(348732081484775, 10).GetFeePerK()
	const CAmount fee = std::min<CAmount>(ConsumeMoney(fuzzed_data_provider), std::numeric_limits<CAmount>::max() / static_cast<CAmount>(100000));

bitcoin/src/test/fuzz/fee_rate.cpp

Lines 24 to 26 in 795afe6

	if (!MultiplicationOverflow(static_cast<int64_t>(bytes), satoshis_per_k) && bytes <= static_cast<uint64_t>(std::numeric_limits<int64_t>::max())) {
	(void)fee_rate.GetFee(bytes);
	}

[jonatack]

Thanks @practicalswift. I'm about to open a PR to refactor CFeeRate / feerate.{h,cpp} and will verify its behavior with respect to this issue.

[adamjonas]

Ref #20790, #20391, and #20546.