Skip to content

🐛 bug: reject out-of-range int and uint in generic parsers on 32-bit - #4832

Merged
ReneWerner87 merged 1 commit into
gofiber:mainfrom
b84330808:fix-generic-parse-int-32bit
Nov 2, 2026
Merged

ReneWerner87 merged 1 commit into
gofiber:mainfrom
b84330808:fix-generic-parse-int-32bit

Conversation

@b84330808

@b84330808 b84330808 commented Nov 2, 2026 •

Copy link
Copy Markdown
Contributor

Description

On 32-bit platforms (386, arm) genericParseType parses int and uint with the 64-bit utils.ParseInt/utils.ParseUint and then converts, so a value that doesn't fit wraps instead of failing. For example fiber.Query[int](c, "n", 10) with ?n=2147483648 returns -2147483648 instead of 10; Params[int] and GetReqHeader[int] do the same. This adds a range check after parsing, which does nothing on 64-bit. I kept utils.ParseInt because of the speed note in constraint.go.

Test_GenericParseTypeInts and Test_GenericParseTypeUints already expect the error when int is 32 bits, but CI has no 32-bit target. With GOARCH=386 they fail before this change (Expected error with "failed to parse value" in chain but got nil.) and pass after. go test . passes on 386 and amd64 (Go 1.27.3), and golangci-lint run --new-from-rev=HEAD~1 . (v2.14.0) reports 0 issues.

Changes introduced

  • Benchmarks: Describe any performance benchmarks and improvements related to the changes.
  • Documentation Update: Detail the updates made to the documentation and links to the changed files.
  • Changelog/What's New: Include a summary of the additions for the upcoming release notes.
  • Migration Guide: If necessary, provide a guide or steps for users to migrate their existing code to accommodate these changes.
  • API Alignment with Express: Explain how the changes align with the Express API.
  • API Longevity: Discuss the steps taken to ensure that the new or updated APIs are consistent and not prone to breaking changes.
  • Examples: Provide examples demonstrating the new features or changes in action.

Type of change

  • Code consistency (non-breaking change which improves code reliability and robustness)

Checklist

  • Followed the inspiration of the Express.js framework for new functionalities, making them similar in usage.
  • Conducted a self-review of the code and provided comments for complex or critical parts.
  • Updated the documentation in the /docs/ directory for Fiber's documentation.
  • Added or updated unit tests to validate the effectiveness of the changes or new features.
  • Ensured that new and existing unit tests pass locally with the changes.
  • Verified that any new dependencies are essential and have been agreed upon by the maintainers/community.
  • Aimed for optimal performance with minimal allocations in the new code.
  • Provided benchmarks for the new code to analyze and improve upon.

I used Claude Code to write this change.

🤖 Maintainers: /generate re-runs the code generators on this branch

@b84330808
b84330808 requested a review from a team as a code owner November 2, 2026 07:33
@welcome

welcome Bot commented Nov 2, 2026

Copy link
Copy Markdown

Thanks for opening this pull request! 🎉 Please check out our contributing guidelines. If you need help or want to chat with us, join us on Discord https://gofiber.io/discord

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-02T07:34:45.831094Z 64c5398 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@ReneWerner87 ReneWerner87 added this to v3 Nov 2, 2026
@ReneWerner87 ReneWerner87 added this to the v3 milestone Nov 2, 2026
@codecov

codecov Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.99%. Comparing base (3a397ad) to head (c5a9a34).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4832      +/-   ##
==========================================
+ Coverage   95.96%   95.99%   +0.02%     
==========================================
  Files         153      153              
  Lines       19707    19707              
==========================================
+ Hits        18912    18917       +5     
+ Misses        484      479       -5     
  Partials      311      311              
Flag Coverage Δ
unittests 95.99% <100.00%> (+0.02%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

On 386 and arm, genericParseType parsed int and uint at 64 bits and
converted the result, so Query[int], Params[int] and GetReqHeader[int]
returned a wrapped value for a number that does not fit instead of the
default value. Test_GenericParseTypeInts and Test_GenericParseTypeUints
already expect the error and fail with GOARCH=386.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@gaby
gaby force-pushed the fix-generic-parse-int-32bit branch from 64c5398 to c5a9a34 Compare November 2, 2026 12:55
@coderabbitai

coderabbitai Bot commented Nov 2, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review.

Recent review info
Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Repository UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 139fb0f0-0cc8-4539-9f80-8c9acc5444b9
Commits

Reviewing files that changed from the base of the PR and between 3a397ad and c5a9a34.

Files selected for processing: 1
  • helpers.go

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Walkthrough

Integer parsing now checks whether parsed values fit the platform-sized int or uint type. It returns errParseValue when parsing fails or a round-trip conversion changes the value.

Changes

Platform-sized integer validation

Layer / File(s) Summary
Integer conversion checks
helpers.go
int and uint parsing now returns errParseValue if conversion to the platform-sized type and back changes the value. Parse errors continue to return the same error.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: Minimal · up to c5a9a

The range checks address the reported 32-bit parsing issue without changing valid 64-bit conversions.

Pre-merge checks: Passed 5
Check name Status Explanation
Title check Passed The title clearly identifies the main change: rejecting out-of-range int and uint values in generic parsers on 32-bit platforms.
Description check Passed The description clearly explains the overflow bug, affected APIs, implementation, test results, and selected change type. Some template items remain incomplete, including the issue reference, change-d…
Docstring Coverage Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description clearly explains the overflow bug, affected APIs, implementation, test results, and selected change type. Some template items remain incomplete, including the issue reference, change-detail checkboxes, and checklist confirmations, but the core description is complete and relevant.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 1 files.

Finishing Touches
Generate unit tests (beta)
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

⚠️ This pull request shows signs of AI-generated slop (ai_padded_prose). It has been flagged by CodeRabbit slop detection and should be reviewed carefully.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

I’m a rabbit, ears upright,
I check each number fits just right.
If round trips change what values say,
I send errParseValue on its way.
Then hop along beneath the moon,
With integers checked in tune.

@ReneWerner87
ReneWerner87 merged commit 097b9d1 into gofiber:main Nov 2, 2026
26 checks passed
@welcome

welcome Bot commented Nov 2, 2026

Copy link
Copy Markdown

Congrats on merging your first pull request! 🎉 We here at Fiber are proud of you! If you need help or want to chat with us, join us on Discord https://gofiber.io/discord

@github-project-automation github-project-automation Bot moved this to Done in v3 Nov 2, 2026
@ReneWerner87 ReneWerner87 modified the milestones: v3, v3.7.0 Nov 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

2 participants