Proof Portal
jsonparser
ProbeLabs36 findings · 123 requirementsparseInt fast-path threshold off-by-one — 19-digit integers skip overflow check and wrap silently
High-severity issue, currently open.
Introduced
When and where this issue first entered the codebase — the commit it traces back to.
Affected requirements
The requirement(s) this issue violates — click through to the spec.
What this means for you
Plain-language impact — what this issue could mean for your users and your system, before any of the technical detail.
Applications that trust ParseInt/GetInt can silently receive a wrong (wrapped) integer for a large 19-digit value with no error signalled — corrupting balances, quotas, IDs, or limits derived from that number. Intentional demo defect on the proof-demo showcase branch; never shipped.
Reachable via ParseInt/GetInt on attacker-controlled numeric JSON; triggered only by integers of exactly 19 digits that exceed math.MaxInt64, so it is silent and easy to miss.
Technical description
parseInt (bytes.go) has an unchecked fast path for short digit runs and an overflow-checked slow path for long ones, gated by a digit-count threshold. On the proof-demo showcase branch that threshold was moved from `if l-i < 19` to `if l-i < 20` (bytes.go:27), so a 19-digit value now takes the unchecked fast path and is accumulated with plain int64 arithmetic that wraps around on overflow instead of routing through the overflow-checked slow path. This is a CWE-190 Integer Overflow (with a downstream CWE-704 Incorrect Type Conversion): a 19-digit literal above math.MaxInt64 returns a silently wrapped, wrong int64 with a nil error rather than OverflowIntegerError. Intentional demo defect on the proof-demo showcase branch; never shipped.
Severity, explained
Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).
- why this rating
- Risk-rated
- risk area
- Data Integrity
- CVSS
- CVSS 7.5· Highv3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVE surface
- Unlikely
Where it is
The code the issue lives in — peek the affected function inline to see it in context.
- parseInt
How it's proven
The reproducer — an actual test that drives the real code and shows the issue happening. Run it yourself, or peek the test and the source it covers.
go test -run TestDemoKI7 -count=1 .
Reproduction steps
Technical steps for your engineers to confirm the issue by hand.
- Check out the proof-demo showcase branch and build the package.
- Call jsonparser.GetInt on a document whose value is 9999999999999999999 — or run: go test -run TestDemoKI7 -count=1 .
- Observe a silently wrapped negative int64 with a nil error instead of OverflowIntegerError.
- Revert bytes.go:27 to `if l-i < 19` and re-run; the reproducer now returns the overflow error.
go test -run TestDemoKI7 -count=1 . go test ./... -count=1
How it can be triggered
The input or condition that sets this issue off.
a 19-digit integer literal exceeding int64, e.g. 9999999999999999999
What protects you, and the fix
What limits your exposure today, and the planned remediation.
What protects you now
Validate numeric magnitude/length before trusting ParseInt output, or parse large integers as strings and range-check them, until the fast-path threshold is restored.
The fix
Restore the 19-digit fast-path threshold in parseInt (bytes.go:27, `if l-i < 20` -> `if l-i < 19`) so any integer of 19-or-more digits is routed through the overflow-checked path and returns OverflowIntegerError for out-of-range input. Closes CWE-190 Integer Overflow / CWE-704 Incorrect Type Conversion.
Blast radius
If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them.
Touch this finding and you re-check 4 requirements · 2 code files · 9 tests.
- parser.go
- fuzz.go
- mcdc_spec_witnesses_test.go
- obligation_evidence_test.go
- parser_test.go
- deep_spec_test.go
- bytes_test.go
- fuzz_native_test.go
- mcdc_supplement_test.go
- property_test.go
- and 1 more
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
- proof/evidence/KI-7-reproducer.yaml
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.