[CASSANDRA-14098] Potential Integer Overflow

• Type: Bug
• Status: Awaiting Feedback
• Priority: Low
• Resolution: Unresolved
• Component/s: Legacy/Core
• Labels: lhf
• Severity: Low
• Complexity: Low Hanging Fruit
• Assignee: Unassigned
• Reporter: songwanging
• Created: 05/Dec/17 22:03
• Updated: 10/Jul/19 11:13

Description

Our tool DeepTect has detected a potential integer overflow:

Path: cassandra/src/java/org/apache/cassandra/service/StorageService.java

...
long totalRowCountEstimate = cfs.estimatedKeysForRange(range);
...
 int splitCount = Math.max(1, Math.min(maxSplitCount, (int)(totalRowCountEstimate / keysPerSplit)));

In the above code snippet, "totalRowCountEstimate" is a long variable, "keysPerSplit" is an integer variable. If "totalRowCountEstimate" is super large, directly casting "(totalRowCountEstimate / keysPerSplit" into integer will definitely lead to a potential integer overflow.