Reject out-of-range and empty integer field values

fix_int.go

@@ -17,6 +17,7 @@ package quickfix
 
 import (
 	"errors"
+	"math"
 	"strconv"
 )
 
@@ -31,6 +32,10 @@ const (
 
 // atoi is similar to the function in strconv, but is tuned for ints appearing in FIX field types.
 func atoi(d []byte) (int, error) {
+	if len(d) == 0 {
+		return 0, errors.New("empty bytes")
+	}
+
 	if d[0] == asciiMinus {
 		n, err := parseUInt(d[1:])
 		return (-1) * n, err
@@ -52,7 +57,13 @@ func parseUInt(d []byte) (n int, err error) {
 			return
 		}
 
-		n = n*10 + (int(dec) - ascii0)
+		digit := int(dec) - ascii0
+		if n > (math.MaxInt-digit)/10 {
+			err = errors.New("value out of range")
+			return
+		}
+
+		n = n*10 + digit
 	}
 
 	return

fix_int_test.go

@@ -42,6 +42,26 @@ func TestFIXInt_Int(t *testing.T) {
 	assert.Equal(t, 4, f.Int())
 }
 
+func TestFIXInt_ReadOutOfRange(t *testing.T) {
+	// Out-of-range values must be rejected, not silently wrapped.
+	for _, tc := range []string{
+		"9223372036854775808",  // math.MaxInt64 + 1
+		"18446744073709551617", // math.MaxUint64 + 1
+		"99999999999999999999",
+	} {
+		var field FIXInt
+		err := field.Read([]byte(tc))
+		assert.NotNilf(t, err, "expected out-of-range error for %q", tc)
+	}
+}
+
+func TestFIXInt_ReadEmpty(t *testing.T) {
+	// An empty value must return an error, not panic on d[0].
+	var field FIXInt
+	err := field.Read([]byte(""))
+	assert.NotNil(t, err, "expected error for empty bytes")
+}
+
 func BenchmarkFIXInt_Read(b *testing.B) {
 	intBytes := []byte("1500")
 	var field FIXInt