Merge pull request #42 from trimble-oss/security_updates_2.7

Try alternate fix for these casts using strconv

Author: joel-rieke

sql/system_settype.go

@@ -17,6 +17,7 @@ package sql
 import (
 	"math"
 	"reflect"
+	"strconv"
 
 	"github.com/dolthub/vitess/go/sqltypes"
 	"github.com/dolthub/vitess/go/vt/proto/query"
@@ -86,7 +87,13 @@ func (t systemSetType) Convert(v interface{}) (interface{}, error) {
 	case uint64:
 		return t.SetType.Convert(value)
 	case float32:
-		return t.Convert(float64(value))
+		// First convert to string, then pass to float64 handler for consistent processing
+		strValue := strconv.FormatFloat(float64(value), 'f', -1, 32)
+		floatValue, err := strconv.ParseFloat(strValue, 64)
+		if err != nil {
+			return nil, ErrInvalidSystemVariableValue.New(t.varName, v)
+		}
+		return t.Convert(floatValue)
 	case float64:
 		// Float values aren't truly accepted, but the engine will give them when it should give ints.
 		// Therefore, if the float doesn't have a fractional portion, we treat it as an int.
@@ -95,7 +102,12 @@ func (t systemSetType) Convert(v interface{}) (interface{}, error) {
 			if value < float64(math.MinInt64) || value > float64(math.MaxInt64) {
 				return nil, ErrInvalidSystemVariableValue.New(t.varName, v) // Reject out-of-range values
 			}
-			intValue := int64(value)
+			// Convert float64 to string and then to int64 to avoid unsafe type casting
+			strValue := strconv.FormatFloat(value, 'f', 0, 64)
+			intValue, err := strconv.ParseInt(strValue, 10, 64)
+			if err != nil {
+				return nil, ErrInvalidSystemVariableValue.New(t.varName, v)
+			}
 			return t.SetType.Convert(intValue)
 		}
 		return nil, ErrInvalidSystemVariableValue.New(t.varName, v) // Reject out-of-range values

sql/timetype.go

@@ -178,8 +178,23 @@ func (t timespanType) ConvertToTimespan(v interface{}) (Timespan, error) {
 		if value < float64(math.MinInt64) || value > float64(math.MaxInt64) {
 			return Timespan(0), fmt.Errorf("float64 value %f exceeds int64 bounds", value)
 		}
-		intValue := int64(value)
-		microseconds := int64Abs(int64(math.Round((value - float64(intValue)) * float64(microsecondsPerSecond))))
+		// Convert float64 to string and then to int64 to avoid direct casting
+		strValue := strconv.FormatFloat(value, 'f', 0, 64)
+		intValue, err := strconv.ParseInt(strValue, 10, 64)
+		if err != nil {
+			return Timespan(0), fmt.Errorf("error converting float64 to int64: %v", err)
+		}
+
+		// Calculate fractional part (microseconds) safely
+		fractionalPart := value - float64(intValue)
+		// Format with 6 decimal places to get microseconds
+		microStr := strconv.FormatFloat(math.Abs(fractionalPart)*float64(microsecondsPerSecond), 'f', 0, 64)
+		microValue, err := strconv.ParseInt(microStr, 10, 64)
+		if err != nil {
+			return Timespan(0), fmt.Errorf("error converting microseconds: %v", err)
+		}
+		microseconds := int64Abs(microValue)
+
 		absValue := int64Abs(intValue)
 		if absValue >= -59 && absValue <= 59 {
 			totalMicroseconds := (absValue * microsecondsPerSecond) + microseconds