Skip to content

Commit 6af9c22

Browse files
authored
fix: Handle integer overflow (#1996)
#### Summary <!-- 🎉 Thank you for making CloudQuery awesome by submitting a PR 🎉 --> Fixes https://github.com/cloudquery/plugin-sdk/security/code-scanning/3 Fixes https://github.com/cloudquery/plugin-sdk/security/code-scanning/2 Fixes https://github.com/cloudquery/plugin-sdk/security/code-scanning/1 Technically a false positive since on 64 machines (we only compile to 64 bit) `int` and `int64` (`number` is `int64`) usually have the same size so no overflow --- Use the following steps to ensure your PR is ready to be reviewed - [ ] Read the [contribution guidelines](../blob/main/CONTRIBUTING.md) 🧑‍🎓 - [ ] Run `go fmt` to format your code 🖊 - [ ] Lint your changes via `golangci-lint run` 🚨 (install golangci-lint [here](https://golangci-lint.run/usage/install/#local-installation)) - [ ] Update or add tests 🧪 - [ ] Ensure the status checks below are successful ✅
1 parent 32855ea commit 6af9c22

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

configtype/time.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package configtype
33
import (
44
"encoding/json"
55
"fmt"
6+
"math"
67
"regexp"
78
"strconv"
89
"time"
@@ -237,10 +238,19 @@ func (d *timeDuration) addUnit(unit string, number int64) error {
237238
case "hour", "hours":
238239
d.duration += time.Hour * time.Duration(number)
239240
case "day", "days":
241+
if number < math.MinInt || number > math.MaxInt {
242+
return fmt.Errorf("invalid %s value: %d. Out of bounds", unit, number)
243+
}
240244
d.days += int(number)
241245
case "month", "months":
246+
if number < math.MinInt || number > math.MaxInt {
247+
return fmt.Errorf("invalid %s value: %d. Out of bounds", unit, number)
248+
}
242249
d.months += int(number)
243250
case "year", "years":
251+
if number < math.MinInt || number > math.MaxInt {
252+
return fmt.Errorf("invalid %s value: %d. Out of bounds", unit, number)
253+
}
244254
d.years += int(number)
245255
default:
246256
return fmt.Errorf("invalid unit: %q", unit)

0 commit comments

Comments
 (0)