Require that z_importkey height parameter be in valid range

src/test/rpc_wallet_tests.cpp

@@ -503,6 +503,14 @@ BOOST_AUTO_TEST_CASE(rpc_wallet_z_importexport)
     BOOST_CHECK_THROW(CallRPC("z_importkey way too many args"), runtime_error);
     BOOST_CHECK_THROW(CallRPC("z_exportkey toomany args"), runtime_error);
 
+    // error if invalid args
+    auto sk = libzcash::SpendingKey::random();
+    std::string prefix = std::string("z_importkey ") + CZCSpendingKey(sk).ToString() + " yes ";
+    BOOST_CHECK_THROW(CallRPC(prefix + "-1"), runtime_error);
+    BOOST_CHECK_THROW(CallRPC(prefix + "2147483647"), runtime_error); // allowed, but > height of active chain tip
+    BOOST_CHECK_THROW(CallRPC(prefix + "2147483648"), runtime_error); // not allowed, > int32 used for nHeight
+    BOOST_CHECK_THROW(CallRPC(prefix + "100badchars"), runtime_error);
+
     // wallet should currently be empty
     std::set<libzcash::PaymentAddress> addrs;
     pwalletMain->GetPaymentAddresses(addrs);

src/wallet/rpcdump.cpp

@@ -607,6 +607,9 @@ UniValue z_importkey(const UniValue& params, bool fHelp)
     int nRescanHeight = 0;
     if (params.size() > 2)
         nRescanHeight = params[2].get_int();
+    if (nRescanHeight < 0 || nRescanHeight > chainActive.Height()) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Block height out of range");
+    }
 
     string strSecret = params[0].get_str();
     CZCSpendingKey spendingkey(strSecret);