Integer Overflow in Echo Go with Cockroachdb

An integer overflow in an Echo Go service that interacts with CockroachDB can lead to invalid calculations, SQL errors, or unsafe query parameters. When user-supplied numeric input is used to compute limits, offsets, or array sizes, and the values are not validated before being used in SQL statements or Go arithmetic, the combination of Go’s wrapping arithmetic and CockroachDB’s handling of large numeric expressions can expose unexpected behavior.

Consider an endpoint that computes a page offset using multiplication: offset := page * pageSize. If page or pageSize are large integers, the multiplication can overflow, producing a negative or small int value. This computed offset is then passed to a CockroachDB query such as SELECT * FROM items OFFSET $1 LIMIT $2. Because the overflowed offset may become a very large unsigned value when interpreted as uint, or a negative int when used in a LIMIT clause, CockroachDB may reject the query or produce incorrect result sets, bypassing intended data access controls.

For example, an attacker could supply a high page number that causes the offset to wrap around to zero or a small value, effectively retrieving data they should not see or causing the query to scan unintended rows. In worst cases, malformed numeric inputs can trigger SQL errors that leak schema or version details through verbose error messages, aiding further exploitation. The risk is higher when input validation is limited to client-side checks or when developers assume CockroachDB will always enforce safe numeric ranges.

In the context of middleBrick’s checks, this scenario maps to the Input Validation and BOLA/IDOR categories. The scanner tests whether large or unexpected numeric values are accepted without server-side bounds checking and whether query behavior changes unexpectedly when large integers are supplied. Remediation requires explicit validation in Go before constructing SQL queries, using safe arithmetic with overflow checks, and ensuring CockroachDB queries use parameterized statements with validated integer bounds.

To prevent integer overflow when working with CockroachDB in Echo Go, validate and sanitize all numeric inputs before using them in SQL statements. Use Go’s math package to detect overflow during arithmetic operations, and enforce strict bounds for pagination, batch sizes, and array indices. Always use parameterized queries to avoid injecting computed values directly into SQL strings.

Example: safe pagination with overflow protection.

package main

import (
    "math"
    "net/http"
    "strconv"

    "github.com/labstack/echo/v4"
)

func listItems(c echo.Context) error {
    pageStr := c.QueryParam("page")
    sizeStr := c.QueryParam("size")

    page, err := strconv.Atoi(pageStr)
    if err != nil || page < 1 {
        return echo.NewHTTPError(http.StatusBadRequest, "invalid page")
    }

    size, err := strconv.Atoi(sizeStr)
    if err != nil || size < 1 || size > 100 {
        return echo.NewHTTPError(http.StatusBadRequest, "invalid size")
    }

    // Check for potential overflow before multiplication
    if page > (math.MaxInt64 / size) {
        return echo.NewHTTPError(http.StatusBadRequest, "page or size too large")
    }
    offset := page * size

    // Use parameterized query to CockroachDB
    rows, err := db.Query(c.Request().Context(),
        "SELECT id, name FROM items OFFSET $1 LIMIT $2",
        offset, size)
    if err != nil {
        return echo.NewHTTPError(http.StatusInternalServerError, "database error")
    }
    defer rows.Close()

    var items []Item
    for rows.Next() {
        var it Item
        if err := rows.Scan(&it.ID, &it.Name); err != nil {
            return echo.NewHTTPError(http.StatusInternalServerError, "scan error")
        }
        items = append(items, it)
    }
    return c.JSON(http.StatusOK, items)
}

Example: safe arithmetic for constructing batch keys or counters.

func safeAdd(a, b int64) (int64, error) {
    if b > 0 && a > math.MaxInt64 - b {
        return 0, errors.New("integer overflow")
    }
    if b < 0 && a < math.MinInt64 - b {
        return 0, errors.New("integer underflow")
    }
    return a + b, nil
}

For CockroachDB, ensure that columns expected to hold counts or identifiers are defined with appropriate numeric types (e.g., BIGINT or DECIMAL) and that application-level validation aligns with database constraints. Avoid relying on CockroachDB to implicitly clamp values; perform checks in Go before issuing SQL. This approach reduces the likelihood of overflow-related query anomalies and supports consistent behavior across deployments.