Conversation
Signed-off-by: InventiveCoder <liucongcong@outlook.com>
Signed-off-by: xiaochangbai <704566072@qq.com>
opt(framework): optimization Help Instruction
# Conflicts: # framework/src/main/java/org/tron/program/FullNode.java
fix(doc): fix some typos in comment
…develop Merge master into develop
feat(doc): update expired information for readme
fix(CheckStyle): only fix CheckStyle
…to volatile-modifier
1. Bump commons-io from 2.11.0 to 2.18.0 to fix CVE-2024-47554. 2. Bump jackson-databind from 2.13.4.2 to 2.18.3 to fix CVE-2023-35116, CVE-2025-52999. 3. Bump java-util from 1.8.0 to 3.2.0 to fix CVE-2023-34610. 4. Bump libp2p from 2.2.5 to 2.2.6. 5. Bump jetty from 9.4.53 to 9.4.57 to fix CVE-2024-8184. 6. Bump spring from 5.3.18 to 5.3.39 to fix CVE-2023-20863, CVE-2024-38820, CVE-2022-22968, CVE-2022-22970. 7. Remove spring-tx, spring-web, hamcrest-junit, guice, java-sizeof, vavr.
…oting_window_period
feat(doc): update readme for telegram groups and doc link
feat(*): disable market transaction
…riction func(vm): optimize selfdestruct restriction
…signature verification
feat(db): optimize the logic for obtaining transactions that require signature verification
feat(net): optimize transaction processing logic
…6514) * fix: throw exception if system shielded tx is not supported. * update the exception msg.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| byte[] s = Arrays.copyOfRange(sign, 32, 64); | ||
| byte v = sign[64]; | ||
| if (v < 27) { | ||
| v += 27; //revId -> v |
Check failure
Code scanning / CodeQL
Implicit narrowing conversion in compound assignment High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 days ago
In general, implicit narrowing in compound assignments like v += 27 should be avoided when the left-hand side is a smaller type (here, byte) and the right-hand side is an int. The safest fix is to make the narrowing conversion explicit so that it is clear to readers and tools that this is intentional, and to avoid the compound assignment that hides the cast.
For this specific case in crypto/src/main/java/org/tron/common/crypto/Rsv.java, replace the compound assignment v += 27; with a simple assignment that explicitly casts the sum back to byte: v = (byte) (v + 27);. This keeps the exact same runtime behavior (still subject to the same overflow/wrap semantics as before) but removes the implicit narrowing and makes the intent clear. No additional imports, methods, or definitions are needed; the change is limited to the single line inside fromSignature.
| @@ -19,7 +19,7 @@ | ||
| byte[] s = Arrays.copyOfRange(sign, 32, 64); | ||
| byte v = sign[64]; | ||
| if (v < 27) { | ||
| v += 27; //revId -> v | ||
| v = (byte) (v + 27); //revId -> v | ||
| } | ||
| return new Rsv(r, s, v); | ||
| } |
20 participants
What does this PR do?
Merge release_v4.8.1 to master