Function call made to an
unsafe package GSC-G103Use of unsafe calls should be audited
102 count, err := f.Read(dataRaw)
103 i := 0
104 for i < count {
105 packet := (*MsgHeader)(unsafe.Pointer(&dataRaw[i]))106 *packets = append(*packets, packet)
107 i += int(packet.size)
108 }Use of unsafe calls should be audited
56 key := int(uint8(keys[uint16(packet.key) << 1]))
57 for ; j < packet.size; j++ {
58 mappedKey := uint32(keys[(uint16(key % 256) << 1) + 1])
59 currPtr := unsafe.Pointer(uintptr(ptr) + uintptr(j)) 60 switch j & 3 {
61 case 0:
62 *(*uint8)(currPtr) = uint8(uint32(*(*uint8)(currPtr)) - uint32(mappedKey << 1))Use of unsafe calls should be audited
51
52func decrypt() {
53 for _, packet := range encryptedPackets {
54 ptr := unsafe.Pointer(packet) 55 j := uint16(4)
56 key := int(uint8(keys[uint16(packet.key) << 1]))
57 for ; j < packet.size; j++ {Use of unsafe calls should be audited
33 key := int(uint8(keys[uint16(packet.key) << 1]))
34 for ; j < packet.size; j++ {
35 mappedKey := uint32(keys[(uint16(key % 256) << 1) + 1])
36 currPtr := unsafe.Pointer(uintptr(ptr) + uintptr(j)) 37 switch j & 3 {
38 case 0:
39 *(*uint8)(currPtr) = uint8(uint32(*(*uint8)(currPtr)) + uint32(mappedKey << 1))Use of unsafe calls should be audited
28
29func encrypt() {
30 for _, packet := range decryptedPackets {
31 ptr := unsafe.Pointer(packet) 32 j := uint16(4)
33 key := int(uint8(keys[uint16(packet.key) << 1]))
34 for ; j < packet.size; j++ {
Description
Package unsafe contains operations that step around the type safety of Go
programs and may be non-portable. Also note that unsafe package is not
supported by Go 1 compatibility guidelines.
Using the unsafe package in Go gives you low-level memory management and many C language
strengths but provides flexibility to your attacker's application. The pointer arithmetic
is one example of an unsafe package used for the data leak, memory corruption, or even
execution of the attacker's script. Also, it would be best to remember that Go 1 compatibility
guidelines do not protect the "unsafe" package.
Bad practice
package main
import (
"fmt"
"unsafe"
)
type Fake struct{}
func (Fake) Good() {}
func main() {
unsafeM := Fake{}
unsafeM.Good()
intArray := [...]int{1, 2}
fmt.Printf("
intArray: %v
", intArray)
intPtr := &intArray[0]
fmt.Printf("
intPtr=%p, *intPtr=%d.
", intPtr, *intPtr)
addressHolder := uintptr(unsafe.Pointer(intPtr)) + unsafe.Sizeof(intArray[0])
intPtr = (*int)(unsafe.Pointer(addressHolder))
fmt.Printf("
intPtr=%p, *intPtr=%d.
", intPtr, *intPtr)
}