Skip to content

fix(data): integer overflow vulnerabilities in money parsing #181

@cpcloud

Description

@cpcloud

Summary

Code audit revealed critical integer overflow vulnerabilities in money parsing and formatting functions.

Issues Fixed

1. Integer Overflow in parseCents (CRITICAL)

  • Impact: Silent data corruption when parsing very large dollar amounts
  • Root cause: Multiplication by 100 without overflow check
  • Fix: Added bounds check to reject values > $92,233,720,368,547,758

2. math.MinInt64 Negation Overflow (HIGH)

  • Impact: Potential panic when formatting the most negative int64 value
  • Root cause: -math.MinInt64 overflows because abs(MinInt64) > MaxInt64
  • Fix: Special case handling treats MinInt64 as MaxInt64 for display

Testing

Added comprehensive edge case tests:

  • Overflow rejection validation
  • Max safe value acceptance
  • MinInt64 formatting without panic

All tests pass. Full audit documented in CODE_REVIEW_FINDINGS.md.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingdataData layer, models, database

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions