G115 does not recognize overflow check conditions if the comparison order is different

[etabegro]

Rule G115 warns if an integer overflow is not correctly checked before conversion. The check currently depends on the comparison order in the if statement:

This works:

if a < 0 || a > math.MaxUint8 {
    return nil, err
}

b := uint8(a)

This does not work (i.e. the rule will warn of a potential overflow):

if 0 > a  || a > math.MaxUint8 {
    return nil, err
}

b := uint8(a)

[oittaa]

It's unclear what a is in your example. Could you provide a complete file?

This does not trigger as expected.

package main

import "math"

func myFunc(a uint) uint8 {
        if a > 0 || a > math.MaxUint8 {
                return 0
        }
        b := uint8(a)
        return b
}

This triggers as expected since a can be negative.

package main

import "math"

func myFunc(a int) uint8 {
        if a > 0 || a > math.MaxUint8 {
                return 0
        }
        b := uint8(a)
        return b
}

[etabegro]

Sorry, here is a complete example. This also triggers, although a cannot be negative:

package main

import "math"

func myFunc(a int) uint8 {
	if 0 > a || a > math.MaxUint8 {
		return 0
	}
	b := uint8(a)
	return b
}

[oittaa]

Oh sorry from my part, I accidentally wrote the wrong operator while making the complete example. :)

I've verified that this bug exists in the latest released version v2.22.11, but it's already fixed in the master branch. The analyzer does much better job at figuring out what the limits of the value could be.

v2.22.11

$ ~/go/bin/gosec /tmp/issues1468/
[gosec] 2026/01/15 21:14:14 Including rules: default
[gosec] 2026/01/15 21:14:14 Excluding rules: default
[gosec] 2026/01/15 21:14:14 Including analyzers: default
[gosec] 2026/01/15 21:14:14 Excluding analyzers: default
[gosec] 2026/01/15 21:14:14 Import directory: /tmp/issues1468
[gosec] 2026/01/15 21:14:14 Checking package: main
[gosec] 2026/01/15 21:14:14 Checking file: /tmp/issues1468/main.go
Results:


[/tmp/issues1468/main.go:9] - G115 (CWE-190): integer overflow conversion int -> uint8 (Confidence: MEDIUM, Severity: HIGH)
    8:  }
  > 9:  b := uint8(a)
    10:         return b

Autofix:

Summary:
  Gosec  : dev
  Files  : 1
  Lines  : 11
  Nosec  : 0
  Issues : 1

Master branch (9f20212)

$ ./gosec -version
Version: 9f20212
Git tag:
Build date: 2026-01-15T20:18:38Z

$ ./gosec /tmp/issues1468/
[gosec] 2026/01/15 21:19:19 Including rules: default
[gosec] 2026/01/15 21:19:19 Excluding rules: default
[gosec] 2026/01/15 21:19:19 Including analyzers: default
[gosec] 2026/01/15 21:19:19 Excluding analyzers: default
[gosec] 2026/01/15 21:19:19 Import directory: /tmp/issues1468
[gosec] 2026/01/15 21:19:19 Checking package: main
[gosec] 2026/01/15 21:19:19 Checking file: /tmp/issues1468/main.go
Results:


Summary:
  Gosec  : 9f20212
  Files  : 1
  Lines  : 11
  Nosec  : 0
  Issues : 0