Skip to content

Commit

Permalink
Fix incorrect integer conversion (#10188)
Browse files Browse the repository at this point in the history
This was caught by CodeQL. We parsed as a 64 bit but then convert to a
(possibly 32 bit) `uint`. It would be 64 bit on most platforms, but we
actually use a 32 bit `int` type in MySQL as well.
  • Loading branch information
zwass authored Mar 1, 2023
1 parent 2154c13 commit 9b1583b
Show file tree
Hide file tree
Showing 2 changed files with 27 additions and 1 deletion.
2 changes: 1 addition & 1 deletion server/fleet/packs.go
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ func (p *Pack) teamPack() (*uint, error) {
return nil, nil
}
t := strings.TrimPrefix(*p.Type, "team-")
teamID, err := strconv.ParseUint(t, 10, 64)
teamID, err := strconv.ParseUint(t, 10, 32)
if err != nil {
return nil, err
}
Expand Down
26 changes: 26 additions & 0 deletions server/fleet/packs_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import (
"testing"

"github.com/fleetdm/fleet/v4/server/ptr"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)

Expand Down Expand Up @@ -107,3 +108,28 @@ func TestPack_Marshal(t *testing.T) {
require.NoError(t, err)
require.NotNil(t, m["disabled"], "marshalled pack does not contain disabled field: %s", string(b))
}

func TestPack_TeamPack(t *testing.T) {
p := Pack{
ID: 13,
Name: "team-foobar",
Type: ptr.String("team-27"),
}
id, err := p.teamPack()
require.NoError(t, err)
assert.Equal(t, uint(27), *id)

p.Type = ptr.String("other")
id, err = p.teamPack()
assert.NoError(t, err)
assert.Nil(t, id)

p.Type = nil
id, err = p.teamPack()
assert.NoError(t, err)
assert.Nil(t, id)

p.Type = ptr.String("team-foobar")
_, err = p.teamPack()
assert.Error(t, err)
}

0 comments on commit 9b1583b

Please sign in to comment.