aws / aws/smithy-go

encoding/cbor: AsFloat64 accepts integrals in (2^53, 2^54] and rounds them silently

Open Beginner friendly
#707 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
255
Forks
81
Avg merge
1d 6h
Merged PRs (30d)
7

Description

`encoding/cbor.AsFloat64` documents that a CBOR uint or negint is converted only if it is within the lossless range, but its bound is `1 << 54` where float64 stops representing every integer at `1 << 53`. A value in (2^53, 2^54] is therefore accepted and rounded: `AsFloat64(Uint(1<<53 + 1))` returns `9007199254740992` with a nil error, and the negint counterpart returns `-9007199254740992`. `AsFloat32` uses the correct bound for its type, `1 << 24`. The rpcv2Cbor codegen emits `AsFloat64` for every modeled double, so a service sending an integral in that range is read one off without any signal.

The fix is one constant, `1 << 54` to `1 << 53`, plus a test that round-trips 0, 1, 2^20, 2^53-1 and 2^53 unchanged and rejects 2^53+1 in both signs. It rejects inputs that are accepted today, which is why this is an issue rather than a pull request; I am happy to open one if you want the change.

Contributor guide

Open the contributing guide

Research direction

Start by locating encoding/cbor.AsFloat64 and the existing conversion tests; compare its integral bound with AsFloat32. Update the bound and add round-trip and rejection coverage for the listed positive and negative values, then confirm rpcv2Cbor-generated doubles no longer silently accept 2^53+1.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
88/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.