No issue reported for slice bounds out of range which causes panic

[domsolutions]

Summary

No issue reported for resclicing a slice whose length is smaller than the reslice upper limit. Could lead to DoS attacks. Staticcheck also doesn't seem to alert on this.

Steps to reproduce the behavior

Run against

package main

import "fmt"

func main() {

	bb := make([]byte, 0)

	fmt.Println(bb[:3])

}

Reports no errors

dominic@dominic-XPS-15-9550:~/go/src/github.com/securego/gosec(master)$ ./gosec /home/dominic/go/src/github.com/securego/gosec/cmd/buggy
[gosec] 2023/04/29 09:45:39 Including rules: default
[gosec] 2023/04/29 09:45:39 Excluding rules: default
[gosec] 2023/04/29 09:45:39 Import directory: /home/dominic/go/src/github.com/securego/gosec/cmd/buggy
[gosec] 2023/04/29 09:45:39 Checking package: main
[gosec] 2023/04/29 09:45:39 Checking file: /home/dominic/go/src/github.com/securego/gosec/cmd/buggy/my-buggy-code.go
Results:


Summary:
  Gosec  : dev
  Files  : 1
  Lines  : 11
  Nosec  : 0
  Issues : 0

dominic@dominic-XPS-15-

gosec version

Latest from master

Go version (output of 'go version')

go version go1.19 linux/amd64

Operating system / Environment

Ubuntu 18.04

Expected behavior

Maybe report an error length has not been verified so may cause a panic?

Actual behavior

No issue reported.

[ccojocar]

Thanks for reporting this. This looks like a good enhancement but probably can be detected only a constant slice bound.

[morgenm]

I created this PR for this: #973

[ccojocar]

fixed by #973