Integer Overflow in Gorilla Mux with Cockroachdb

An integer overflow in a Gorilla Mux application that uses CockroachDB can occur when user-supplied numeric values are parsed into fixed-size integer types (e.g., int32 or int64) and later used in SQL operations or in constructing values that interact with CockroachDB. For example, if an endpoint accepts a query parameter such as limit, and the application does not validate that the value fits within the expected range before using it in a CockroachDB query, an attacker may supply a small number that overflows during arithmetic (e.g., offset + limit), causing the calculation to wrap to a very large value and bypass intended limits or allocate excessive memory.

Gorilla Mux routes HTTP requests based on path variables and query parameters; if these inputs are bound directly to integer fields without validation, an overflowed value may be passed to CockroachDB. In CockroachDB, which behaves like PostgreSQL in many numeric aspects, unexpected large integer inputs can affect row retrieval, pagination, or filtering logic. For instance, an overflowed offset may cause the database to return unintended rows or trigger performance issues due to large scans. Moreover, if the application uses integer values to compute page sizes or batch sizes for CockroachDB reads, an overflow may result in allocation of insufficient buffers or creation of excessively large requests, potentially leading to crashes or information leakage through error messages.

Consider an endpoint that computes a pagination cursor using 32-bit integers:

// Vulnerable: no validation before arithmetic
page, _ := strconv.Atoi(r.URL.Query().Get("page"))
pageSize, _ := strconv.Atoi(r.URL.Query().Get("pageSize"))
offset := page * pageSize // integer overflow possible if page or pageSize is large
cursor := offset + 100     // further overflow risk

If page or pageSize are large enough, the multiplication or addition can overflow. When this computed offset is passed to a CockroachDB query, the behavior may diverge from expectations, potentially exposing more data than intended or causing runtime errors that reveal stack traces or internal details.

Real-world integer overflow issues often map to weaknesses in input validation and improper use of numeric types, which can be exacerbated when integrating with strong consistency databases like CockroachDB where queries may touch many rows. The risk is not only data exposure but also potential instability in service behavior when large integer values reach the database layer.

Remediation focuses on validating and sanitizing all user-supplied integers before they reach CockroachDB, using explicit range checks and types that reduce overflow risk. In Go, prefer int64 for database-bound values when interacting with CockroachDB, and use math.MaxInt64 and math.MinInt64 to validate boundaries. Use CockroachDB-compatible queries with placeholders to avoid constructing SQL strings from raw integers.

Below is a secure pattern for pagination that avoids overflow and safely passes values to CockroachDB:

// Secure: validated inputs and safe SQL parameter usage
const maxPageSize = 1000
var page, pageSize int64
{
    p, errP := strconv.ParseInt(r.URL.Query().Get("page"), 10, 64)
    s, errS := strconv.ParseInt(r.URL.Query().Get("pageSize"), 10, 64)
    if errP != nil || errS != nil || p <= 0 || s <= 0 || s > maxPageSize {
        http.Error(w, "invalid parameters", http.StatusBadRequest)
        return
    }
    page, pageSize = p, s
}
offset := (page - 1) * pageSize
if offset < 0 { // overflow or negative check
    http.Error(w, "invalid offset", http.StatusBadRequest)
    return
}

When executing queries against CockroachDB, use the CockroachDB Go driver with parameterized statements to ensure values are handled safely:

// Using CockroachDB with parameterized queries
ctx := context.Background()
conn, err := sql.Open("cockroachdb", "postgresql://root@localhost:26257/defaultdb?sslmode=disable")
if err != nil {
    log.Fatal(err)
}
defer conn.Close()

var rows *sql.Rows
rows, err = conn.QueryContext(ctx, `SELECT id, name FROM users WHERE status = $1 LIMIT $2 OFFSET $3`, "active", pageSize, offset)
if err != nil {
    http.Error(w, "database error", http.StatusInternalServerError)
    return
}
defer rows.Close()

For operations that involve counters or accumulated values (e.g., computing totals or batch sizes), use checked arithmetic or big.Int when necessary, and validate against reasonable limits before sending values to CockroachDB. Also ensure that any client-supplied sorting or filtering fields are enumerated rather than directly interpolated, preventing unexpected large numeric inputs from reaching the database layer.