Address gosec G115/G103 findings

[shamaton]

Overview

Running gosec -quiet -fmt=json ./... reported 277 findings.

Breakdown:

• G115 integer overflow conversion: 272 findings
• G103 use of unsafe calls should be audited: 5 findings

Most findings are integer conversions in MessagePack encode/decode paths.
The decode-side narrowing conversions should be treated as the highest priority because they can silently truncate or wrap attacker-controlled input.

Action Items

1. Add range checks for decode-side narrowing conversions

Affected areas include:

• internal/decoding/interface.go
• internal/decoding/slice.go
• internal/decoding/map.go
• internal/stream/decoding/interface.go
• internal/stream/decoding/slice.go
• internal/stream/decoding/map.go

Examples:

• uint64 -> uint8
• uint64 -> uint16
• uint64 -> uint32
• int64 -> int8
• int64 -> int16
• int64 -> int32

These conversions can currently wrap if the encoded value is outside the destination type’s range. Add explicit checks using limits such as math.MaxUint8, math.MaxUint16, math.MaxUint32, math.MinInt8, etc., and
return a decode error when the value is out of range.

2. Review signed/unsigned conversion behavior

Affected areas include:

• internal/decoding/int.go
• internal/decoding/uint.go
• internal/stream/decoding/int.go
• internal/stream/decoding/uint.go

Examples:

• uint64 -> int64
• negative integer values decoded into uint64
• uint16 -> int16
• uint32 -> int32

Clarify the intended behavior for decoding negative MessagePack integers into unsigned Go types. If negative values should not be accepted for unsigned destinations, return an error instead of converting them to large
unsigned values. Also reject uint64 values that do not fit into int64.

3. Clean up or suppress intentional encode-side byte conversions

Affected areas include:

• internal/encoding/set.go
• internal/stream/encoding/set.go
• ext/encode.go
• ext/encode_stream.go

Many findings here are likely intentional byte extraction for MessagePack wire encoding, such as byte(value >> 8). Prefer encoding/binary.BigEndian.PutUint16/32/64 where it improves clarity. For conversions that are
required by the MessagePack format, add narrowly scoped // #nosec G115 -- ... comments with a clear reason.

4. Remove or audit unsafe string/byte conversions

Affected areas include:

• internal/encoding/string.go
• internal/stream/encoding/string.go
• internal/decoding/bin.go
• internal/stream/decoding/bin.go

The encode-side string -> []byte usage appears unnecessary when only the length is needed; len(str) should be enough. For decode-side []byte -> string, decide whether the copy avoidance is worth the aliasing risk.

Suggested approach:

• Replace with safe conversions where practical.
• Run benchmarks if performance is a concern.
• If unsafe remains necessary, add narrowly scoped // #nosec G103 -- ... comments explaining why it is safe.

Done Criteria

• Decode-side narrowing conversions have explicit range checks.
• Signed/unsigned decode behavior is documented and enforced.
• Intentional encode-side byte conversions are either made clearer or suppressed with reasons.
• Unsafe usage is removed or documented as audited.
• gosec ./... reports only fixed or intentionally suppressed findings.
• Existing tests pass.
• Tests are added for out-of-range decode inputs.