I worked on my first open-source package last weekend.
ccoVeille / go-safecast
Safe number conversion in Go: address gosec G115 and cwe-190 Integer Overflow or Wraparound
🪄 go-safecast: safe numbers conversion
go-safecast solves the type conversion issues in Go
In Go, integer type conversion can lead to a silent and unexpected behavior and errors if not handled carefully.
This package helps to convert any number to another, and report an error when if there would be aloss or overflow in the conversion
Usage
package mainimport ("fmt""math""github.com/ccoveille/go-safecast")funcmain() {varainta=42b,err:=safecast.ToUint8(a)// everything is fineiferr!=nil {fmt.Println(err) }fmt.Println(b)// Output: 42a=255+1_,err=safecast.ToUint8(a)// 256 is greater than uint8 maximum valueiferr!=nil {fmt.Println(err)// Output: conversion issue: 256…
About the story behind this library, you can read my first article about integer overflow in Go
As I found nothing to cope with this kind of error, except adding a lot of boilerplate for each cast to do, so I decided to make my own Go package.
@ldemailly helped me to review the code, thank.
The package is now mature enough for me to talk about it.
So instead of this
varaintvarbuint8a=255+1b=uint8(a)ifa<0||a>math.MaxUint8{log.Println("overflow")}fmt.Println(b)a=-1b=uint8(a)ifa<0||a>math.MaxUint8{log.Println("overflow")}fmt.Println(b)c,d:=255,300res:=max(c,d)ifres<0||res>math.MaxInt8{log.Println("overflow")}fmt.Println(int8(res))str:="\x99"// hexadecimal representation of Trademark ASCII character: ™e:=str[0]ife<0||e>math.MaxInt8{log.Println("overflow")}fmt.Println(int8(e))You can now do this
varaintvarbuint8a=255+1b,err:=safecast.ToUint8(a)iferr!=nil{log.Println(err)}fmt.Println(b)a=-1b,err=safecast.ToUint8(a)iferr!=nil{log.Println(err)}fmt.Println(b)c,d:=255,300res:=max(c,d)g,err:=safecast.ToInt8(res)iferr!=nil{log.Println(err)}fmt.Println(g)str:="\x99"// hexadecimal representation of Trademark ASCII character: ™e:=str[0]f,err:=safecast.ToUint8(e)iferr!=nil{log.Println(err)}fmt.Println(f)I'm curious about your feedbacks
Top comments(1)
Great series on a serious problem, and thanks for the mention!
If you don’t mind I’d like to offer my smaller and simpler (I think) generic version:pkg.go.dev/fortio.org/safecast for people to consider. It also has Must* variant of the conversions.
For further actions, you may consider blocking this person and/orreporting abuse
