From 1032e07f9d6ff83df0faaf259c1073f728a99d68 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 17 Jul 2026 05:08:22 +0000 Subject: [PATCH] fix(conv): correct bounds check in ToInt to prevent unsafe integer conversion The guard in ToInt used `||`, making the condition always true (any int64 is either <= math.MaxInt or >= math.MinInt), so `int(i)` was performed without an effective range check. On a 32-bit platform this allows a value outside the int range to be truncated instead of returning the intended sentinel. Use `&&` so the value is verified to lie within [math.MinInt, math.MaxInt] before the conversion. On 64-bit platforms behaviour is unchanged; on 32-bit platforms out-of-range values now correctly return -1. Fixes the CodeQL go/incorrect-integer-conversion (CWE-681) alert. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01LRikukPomDzH3VYribFNPU --- conv/conv.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conv/conv.go b/conv/conv.go index 9d3e9d508..304636cc5 100644 --- a/conv/conv.go +++ b/conv/conv.go @@ -222,7 +222,7 @@ func ToInt(in interface{}) int { // Protect against CWE-190 and CWE-681 // https://cwe.mitre.org/data/definitions/190.html // https://cwe.mitre.org/data/definitions/681.html - if i := ToInt64(in); i <= math.MaxInt || i >= math.MinInt { + if i := ToInt64(in); i >= math.MinInt && i <= math.MaxInt { return int(i) }