G115: range checks with return

[pmkolo]

Trying to understand the latest G115 update

// number of repetitions from data returned
calcReps := len(payload) / len(ids)

// version 1
repetitions = 255
if calcReps > 0 && calcReps < math.MaxUint8 {
    repetitions = uint8(calcReps) // G115 triggered
}

// version 2
if calcReps < 0 || calcReps >= math.MaxUint8 {
    // repetitions exceed limits - setting max
    repetitions = 255
} else {
    repetitions = uint8(calcReps) // G115 triggered
}

// version 3
if calcReps < 0 || calcReps >= math.MaxUint8 {
    return // well ... not really what I need
}
repetitions = uint8(calcReps) // no G115 

Alternatives 1 and 2 were passing before 2.23.0

So now in order to fulfill the return requirement do I have to setup all possible conversion helpers with/without defaults?

func IntToUint8WithDefault(n int, def uint8) uint8 {
    if n < 0 || n >= math.MaxUint8  {
        return def
    }
    return uint8(n)
}

[ccojocar]

@ravisastryk Please could you help to clarify this issue? Thanks

[ravisastryk]

Thank you @pmkolo for the question you have. This appears to be a regression introduced in commit 0cc9e01 (#1460), which replaced the previous walkBranchForConvert approach (that walked branch instructions to find where the *ssa.Convert actually lived) with isReachable (full CFG graph traversal). This was later promoted into ResolveRange in 7284e15 (#1464) as the `matchCount == 1

I have limited familiarity with this area of the codebase. @oittaa authored these changes and has a much deeper understanding of the range analyzer design, but from what I can tell, the issue is in ResolveRange, the dominator walk uses IsReachable(succ, block) to determine which edge of a dominating If block leads to the conversion. Needs investigation.

I am happy to deep-dive further or defer to @oittaa if an informed fix is preferred. At this time, the workaround would be: suppress with // #nosec G115 on the conversion line.

cc @ccojocar

[ccojocar]

Thanks @ravisastryk for looking into this issue. Please @oittaa can you have a look since you refactored this area lately? Thanks

[oittaa]

Sure, I'll take a look.

[oittaa]

Weird, I can't trigger this bug. Even using the latest master version.

$ ./gosec /tmp/issues1501/...
[gosec] 2026/02/15 05:11:10 Including rules: default
[gosec] 2026/02/15 05:11:10 Excluding rules: default
[gosec] 2026/02/15 05:11:10 Including analyzers: default
[gosec] 2026/02/15 05:11:10 Excluding analyzers: default
[gosec] 2026/02/15 05:11:10 Import directory: /tmp/issues1501
[gosec] 2026/02/15 05:11:11 Checking package: main
[gosec] 2026/02/15 05:11:11 Checking file: /tmp/issues1501/main.go
Results:


Summary:
  Gosec  : 47f8b52
  Files  : 1
  Lines  : 31
  Nosec  : 0
  Issues : 0



$ cat /tmp/issues1501/main.go
package main

import "math"

func guardedAndThen(payload []byte, ids []byte) uint8 {
        calcReps := len(payload) / len(ids)
        var repetitions uint8 = 255
        if calcReps > 0 && calcReps < math.MaxUint8 {
                repetitions = uint8(calcReps)
        }
        return repetitions
}

func guardedOrElse(payload []byte, ids []byte) uint8 {
        calcReps := len(payload) / len(ids)
        var repetitions uint8 = 255
        if calcReps < 0 || calcReps >= math.MaxUint8 {
                repetitions = 255
        } else {
                repetitions = uint8(calcReps)
        }
        return repetitions
}

func guardedOrReturn(payload []byte, ids []byte) uint8 {
        calcReps := len(payload) / len(ids)
        if calcReps < 0 || calcReps >= math.MaxUint8 {
                return 255
        }
        return uint8(calcReps)
}

[oittaa]

@pmkolo

1. Which gosec version are you using?
2. Could you provide a complete test file that triggers the bug?

[pmkolo]

using 2.23.0
indeed, that's correct observation, I was later wondering myself why other conversion places were not affected, looks like this use case trigger is specific, the fetch and conversion is in a loop - e.g. in one project it's SNMP GetBulk data fetch for given OIDs, based on returned data the slice for next fetch is recalculated (OIDs moved forward, completed ones removed) and so is repetition

package main

import (
	"math"
)

func fetchData(ids []string, lastRunReps uint8) uint8 {
        repetitions := lastRunReps
        for len(ids) > 0 {
                payload := []byte{}
                // in a regular scenario e.g. payload, timeout, err := snmpBulkGet(snmpSess, oids, nonrepeaters, repetitions)
                calcReps := len(payload) / len(ids)

                repetitions = 255
                if calcReps > 0 && calcReps < math.MaxUint8 {
                        repetitions = uint8(calcReps) // G115
                }

                if calcReps < 0 || calcReps >= math.MaxUint8 {
                        repetitions = 255
                } else {
                        repetitions = uint8(calcReps) // G115
                }

                if calcReps < 0 || calcReps >= math.MaxUint8 {
                        return 0
                }
                repetitions = uint8(calcReps)

                // calculate new ids from returned payload
                // repeat until all done
        }
        return repetitions
}

[gosec] 2026/02/15 17:23:18 Including rules: default
[gosec] 2026/02/15 17:23:18 Excluding rules: default
[gosec] 2026/02/15 17:23:18 Including analyzers: default
[gosec] 2026/02/15 17:23:18 Excluding analyzers: default
[gosec] 2026/02/15 17:23:18 Import directory: /tmp/1501
[gosec] 2026/02/15 17:23:19 Checking package: main
[gosec] 2026/02/15 17:23:19 Checking file: /tmp/1501/main.go
Results:


[/tmp/1501/main.go:22] - G115 (CWE-190): integer overflow conversion int -> uint8 (Confidence: MEDIUM, Severity: HIGH)
    21:                 } else {
  > 22:                         repetitions = uint8(calcReps) // G115
    23:                 }

Autofix: 

[/tmp/1501/main.go:16] - G115 (CWE-190): integer overflow conversion int -> uint8 (Confidence: MEDIUM, Severity: HIGH)
    15:                 if calcReps > 0 && calcReps < math.MaxUint8 {
  > 16:                         repetitions = uint8(calcReps) // G115
    17:                 }

Autofix: 

Summary:
  Gosec  : 2.23.0
  Files  : 1
  Lines  : 34
  Nosec  : 0
  Issues : 2

[oittaa]

Thanks for the test case! I added a bit simplified version to the test cases for regression testing. While digging through this I found a couple of other potential issues in these more complicated parsing cases and fixed those as well.