Conversation
# Conflicts: # consensus/spos/bls/constants.go # consensus/spos/consensusMessageValidator.go # go.mod # go.sum # process/block/metablock.go
# Conflicts: # go.mod # go.sum
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| roundsPerEpochUint = minRoundModulus | ||
| } | ||
|
|
||
| mp.nrEpochsChanges = int(epochs) |
Check failure
Code scanning / CodeQL
Incorrect conversion between integer types High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 days ago
To fix this safely without changing intended functionality, add explicit bounds checks for epochs before converting it to int, using constant limits for the target int width. Since int width is platform-dependent, compute the max/min int constants in a portable way and reject values outside that range (or clamp/fallback). In this function, the least behavior-changing fix is to log and return early when out of range, so no unsafe state update happens.
Concrete edits in process/block/metablock.go (inside epochsFastForward):
- Right before
mp.nrEpochsChanges = int(epochs), definemaxIntandminIntusing bit operations:maxInt := int64(^uint(0) >> 1)minInt := -maxInt - 1
- Add bound check:
if epochs < minInt || epochs > maxInt { ...; return }
- Keep existing assignment after successful check.
No new imports or dependencies are needed.
| @@ -2962,6 +2962,13 @@ | ||
| roundsPerEpochUint = minRoundModulus | ||
| } | ||
|
|
||
| maxInt := int64(^uint(0) >> 1) | ||
| minInt := -maxInt - 1 | ||
| if epochs < minInt || epochs > maxInt { | ||
| log.Error("epochfastforward", "epochs out of int bounds", "epochs", epochs) | ||
| return | ||
| } | ||
|
|
||
| mp.nrEpochsChanges = int(epochs) | ||
| mp.roundsModulus = roundsPerEpochUint | ||
|
|
# Conflicts: # process/heartbeat/interceptedPeerAuthentication.go
4 participants
Reasoning behind the pull request
Proposed changes
Testing procedure
Pre-requisites
Based on the Contributing Guidelines the PR author and the reviewers must check the following requirements are met:
featbranch created?featbranch merging, do all satellite projects have a proper tag insidego.mod?