Skip to content

Commit

Permalink
doc: commit local changes I forgot 🤦
Browse files Browse the repository at this point in the history
  • Loading branch information
ccoVeille committed Sep 6, 2024
1 parent 644df29 commit 459fa5f
Showing 1 changed file with 13 additions and 3 deletions.
16 changes: 13 additions & 3 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ func main() {

a = 2147483647 + 1
b = int32(a)
fmt.Println(b) // -2147483648 Stack overflow
fmt.Println(b) // -2147483648 integer overflow

c := -1
d := uint32(c)
Expand All @@ -58,14 +58,24 @@ func main() {

GoPlay: [https://go.dev/play/p/9PRWI7e0x1T](https://go.dev/play/p/9PRWI7e0x1T)

### What is the problem ?

[CWE-190](https://cwe.mitre.org/data/definitions/190.html) explains in detail.

But to sum it up, you can face:

- infinite loop
- access to wrong resource by id
- grant access to someone who exhausted their quota

## Motivation

The gosec G115 will now report issues in a lot of project.

Some libraries existed (See [alternatives](#alternatives) section), but they were not able to cover all the use cases.

## Alternatives

Some libraries existed, but they were not able to cover all the use cases.

- [github.com/rung/go-safecast](https://github.com/rung/go-safecast):
Unmaintained, not architecture agnostic, do not support uint -> int conversion

Expand Down

0 comments on commit 459fa5f

Please sign in to comment.