[processor/deltatocumulative]: investigate possible int overflows in internal/data/expo

[sh0rez]

Component(s)

processor/deltatocumulative

What happened?

gosec linter started flagging possible integer overflow errors in recent versions:

deltatocumulativeprocessor/internal/data/expo/expotest/bins.go:45:25: G115: integer overflow conversion int -> int32 (gosec)
	buckets.SetOffset(int32(start - 3))
	                       ^
deltatocumulativeprocessor/internal/data/expo/expotest/bins.go:62:36: G115: integer overflow conversion int -> int32 (gosec)
			bs.SetOffset(bs.Offset() + int32(idx))
			                                ^
deltatocumulativeprocessor/internal/data/expo/expotest/histogram.go:57:19: G115: integer overflow conversion int -> int32 (gosec)
	dp.SetScale(int32(hist.Scale))

while these are not necessarily real security implications, we must investigate

Collector version

bddc8c2

[github-actions]

Pinging code owners:

• processor/deltatocumulative: @sh0rez @RichieSams @jpkrohling

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[sh0rez]

/label processor/deltatocumulative -needs-triage

[github-actions]

Pinging code owners for processor/deltatocumulative: @sh0rez @RichieSams @jpkrohling. See Adding Labels via Comments if you do not have permissions to add labels yourself.

[odubajDT]

I was not able to reproduce the problem locally with the current state of main branch and with gosec. Are you able to reproduce it with gosec ./... or did you use some special parameters?

Thanks!

[github-actions]

This issue has been inactive for 60 days. It will be closed in 60 days if there is no activity. To ping code owners by adding a component label, see Adding Labels via Comments, or if you are unsure of which component this issue relates to, please ping @open-telemetry/collector-contrib-triagers. If this issue is still relevant, please ping the code owners or leave a comment explaining why it is still relevant. Otherwise, please close it.

Pinging code owners:

• processor/deltatocumulative: @sh0rez @RichieSams @jpkrohling

See Adding Labels via Comments if you do not have permissions to add labels yourself.