Skip to content

Fix integer overflow in IPFIX exporter delta calculation#7785

Open
Av1ralS1ngh wants to merge 1 commit intoantrea-io:mainfrom
Av1ralS1ngh:fix/ipfix-integer-overflow-7783
Open

Fix integer overflow in IPFIX exporter delta calculation#7785
Av1ralS1ngh wants to merge 1 commit intoantrea-io:mainfrom
Av1ralS1ngh:fix/ipfix-integer-overflow-7783

Conversation

@Av1ralS1ngh
Copy link

@Av1ralS1ngh Av1ralS1ngh commented Feb 15, 2026

The IPFIX exporter computes delta counts for packets and bytes by subtracting the previous counter value from the current one. The original code cast both uint64 operands to int64 before subtraction, which silently overflows when counter values exceed math.MaxInt64 (~9.2 × 10¹⁸).

This change removes the int64 casts and performs the subtraction directly in uint64 arithmetic, which is correct for monotonically increasing counters and also handles wrap-around naturally. A conditional log is emitted when the current value is less than the previous value (counter reset), preserving observability without altering the exported value.

What changed:

  • pkg/agent/flowexporter/exporter/ipfix.go: replaced int64 casts with direct uint64 subtraction for packetDeltaCount, octetDeltaCount, reversePacketDeltaCount, and reverseOctetDeltaCount.

  • pkg/agent/flowexporter/exporter/ipfix_overflow_test.go [NEW]: table-driven test covering normal deltas, values exceeding MaxInt64, and counter-reset scenarios.

    Fixes Integer overflow in IPFIX exporter delta calculation #7783

Use uint64 arithmetic for delta calculation to prevent overflow.

Add test case for overflow scenario.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Integer overflow in IPFIX exporter delta calculation

1 participant