{"record":{"id":"82f3e9f05d8f80f8","repo":"shadow1ng/fscan","slug":"randomint-range-too-large","errorCode":null,"errorMessage":"randomInt: range too large","messagePattern":"randomInt: range too large","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"webscan/lib/eval_random.go","lineNumber":112,"sourceCode":"\t\t\t\t\treturn types.ValOrErr(value, \"unexpected type '%v' passed to randomString\", value.Type())\n\t\t\t\t}\n\t\t\t\tlength, err := validateRandomStringLength(n)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn types.NewErr(\"%v\", err)\n\t\t\t\t}\n\t\t\t\treturn types.String(randomString(length))\n\t\t\t},\n\t\t},\n\t}\n}\n\nfunc randomIntSpan(min, max int64) (int64, error) {\n\tif max <= min {\n\t\treturn 0, fmt.Errorf(\"randomInt: max(%d) must be greater than min(%d)\", max, min)\n\t}\n\tconst maxInt64 = int64(^uint64(0) >> 1)\n\tif min < 0 && max > maxInt64+min {\n\t\treturn 0, fmt.Errorf(\"randomInt: range too large\")\n\t}\n\treturn max - min, nil\n}\n\nfunc validateRandomStringLength(n types.Int) (int, error) {\n\tif n < 0 || n > maxRandomStringLength {\n\t\treturn 0, fmt.Errorf(\"random string length must be between 0 and %d\", maxRandomStringLength)\n\t}\n\treturn int(n), nil\n}\n","sourceCodeStart":94,"sourceCodeEnd":123,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/webscan/lib/eval_random.go#L94-L123","documentation":"randomIntSpan rejects ranges whose span (max - min) would overflow int64. When min is negative and max exceeds maxInt64 + min, computing max-min overflows, so the function fails fast with \"randomInt: range too large\" instead of returning a wrapped-around value.","triggerScenarios":"Calling randomInt with min < 0 and max - min > math.MaxInt64, e.g. randomInt(math.MinInt64, math.MaxInt64).","commonSituations":"POC expressions using extremely wide integer ranges; generated templates that pass extreme sentinel values for min/max; users trying to get \"any integer\" via full int64 range.","solutions":["Narrow the range so max - min fits in int64 (max <= maxInt64 + min).","If a full-range random is needed, generate two values or use a dedicated full-range generator instead of randomInt.","Clamp min/max to sane bounds before invoking the expression."],"exampleFix":"// before\nv, err := randomIntSpan(math.MinInt64, math.MaxInt64) // overflow\n\n// after\nv, err := randomIntSpan(-1<<62, 1<<62) // span fits in int64","handlingStrategy":"validation","validationCode":"const maxInt64 = int64(^uint64(0) >> 1)\nif min < 0 && max > maxInt64+min {\n    return errors.New(\"range too large\")\n}","typeGuard":null,"tryCatchPattern":"v, err := randomIntSpan(min, max)\nif err != nil {\n    min, max = clampRange(min, max) // shrink and retry\n    v, err = randomIntSpan(min, max)\n}","preventionTips":["Avoid full int64 ranges; clamp min/max to safe bounds like +/-1<<62.","Add a span check in any code path that computes min/max dynamically."],"tags":["validation","overflow","random","integer"],"backgroundTag":"value-out-of-range","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}