Minor SAST warnings

[fyfyrchik]

Hello! I have run https://svace.pages.ispras.ru/svace-website/en/ against neo-go codebase and here are some of the issues found. I think most of them are OK (I ignored issues such as having empty set of oracles in the oracle post-persist)

After discussion of @roman-khimov, I decided to create it here, both seems minor.

1. Here prevHeader could be nil in the else branch.

Message: After having been compared to a nil value at blockchain.go:2984, pointer 'prevHeader' is dereferenced at blockchain.go:2987.

neo-go/pkg/core/blockchain.go

Line 2984 in a13dc59

if prevHeader == nil && currHeader.PrevHash.Equals(util.Uint256{}) {

2. Here an attacker could use NeoFS protocol scheme to cause panic in production node without neofs support

Variable len(t67.MainCfg.NeoFS.Nodes), whose possible value set allows a zero value at request.go:162 by calling function 'builtin.len', is used as a denominator at request.go:162.

neo-go/pkg/services/oracle/request.go

Line 163 in a13dc59

rc, err := neofs.Get(ctx, priv, u, o.MainCfg.NeoFS.Nodes[index])

[roman-khimov]

1. prevHeader is never a nil in reality, but the code is bogus, I agree (since a6610ba).
2. True, but requires a very specific (mis)configuration --- oracle service enabled, but no NeoFS nodes configured.