gnovm: avoid letting malformed strings like ".-400" be passed into apd.Decimal or send patch to cockroachdb/apd

[odeke-em]

Description

I found this bug by fuzzing with this fuzzer

package gnolang

import (
	"os"
	"path/filepath"
	"strings"
	"testing"

	"github.com/cockroachdb/apd/v3"
)

func FuzzConvertUntypedBigdecToFloat(f *testing.F) {
	// 1. Firstly add seeds.
	seeds := []string{
		"-100000",
		"100000",
		"0",
	}

	check := new(apd.Decimal)
	for _, seed := range seeds {
		if check.UnmarshalText([]byte(seed)) == nil {
			f.Add(seed)
		}
	}

	f.Fuzz(func(t *testing.T, apdStr string) {
		switch {
		case strings.HasPrefix(apdStr, ".-"):
			return
		}

		v := new(apd.Decimal)
		if err := v.UnmarshalText([]byte(apdStr)); err != nil {
			return
		}
		if _, err := v.Float64(); err != nil {
			return
		}

		bd := BigdecValue{
			V: v,
		}
		dst := new(TypedValue)
		typ := Float64Type
		ConvertUntypedBigdecTo(dst, bd, typ)
	})
}

we re-discovered a long standing bug in cockroachdb/apd cockroachdb/apd#120 (comment) let's be cautious that strings of that form will cause a panic in gnovm hence either send a fix to apd and can even use it to market gnolang and contribute positively or at least protect against such strings

[kristovatlas]

Thanks for the report, @odeke-em. We're looking into it. And extra thanks for providing the fuzzer source.