Skip to content

Potential fix for code scanning alert no. 5: Size computation for allocation may overflow#2

Draft
bsdrop wants to merge 2 commits into
mainfrom
alert-autofix-5
Draft

Potential fix for code scanning alert no. 5: Size computation for allocation may overflow#2
bsdrop wants to merge 2 commits into
mainfrom
alert-autofix-5

Conversation

@bsdrop
Copy link
Copy Markdown
Owner

@bsdrop bsdrop commented May 14, 2026

Potential fix for https://github.com/bsdrop/lafdb/security/code-scanning/5

To fix this safely without changing functionality, compute the combined capacity once with an overflow guard before using it in make. In Go, the standard pattern is:

  • check if a > math.MaxInt-b before a+b
  • if overflow would occur, return an error instead of allocating

Best concrete fix here:

  1. In internal/scraper/modified.go, import math.
  2. In buildModifiedEvents, before allocations on lines currently using len(oldMap)+len(newMap), add:
    • oldLen := len(oldMap)
    • newLen := len(newMap)
    • overflow guard against math.MaxInt
    • combinedLen := oldLen + newLen
  3. Use combinedLen for both ids and seen capacities.
  4. Return an error (using existing fmt.Errorf) if overflow is detected.

This addresses all three alert variants because they all flow into the same vulnerable sink in buildModifiedEvents.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…ocation may overflow

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Comment thread internal/scraper/modified.go Fixed
… allocation may overflow'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants