Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hi,
I am not sure why the
share_length
andsecret_length
variables are defined as typeuint32_t
but both are being compared to auint8_t
in a loop condition. This causes CodeQL to give a high severity security warning. 'High Severity' is probably a bit alarmist but in a loop condition, comparison of a value of a narrow type with a value of a wide type may result in unexpected behaviour if the wider value is sufficiently large (or small). This is because the narrower value may overflow. This can lead to an infinite loop.See here for further explanation of the warning:
Comparison of narrow type with wide type in loop condition
This PR fixes #42 by casting
share_length
andsecret_length
touint8_t
ensuring comparison of same types. If type casting is not the solution then maybeshare_length
andsecret_length
should be declared asuint8_t
notuint32_t
?Note: I chose to cast to the narrower
uint8_t
rather than declaringj
as the wideruint32_t
as I think neithershare_length
orsecret_length
should ever be bigger than 255.