Safeconv API

The piko.sh/piko/wdk/safeconv package provides integer type conversions that clamp (saturate) to the destination type's range instead of silently wrapping. Negative values become zero for unsigned destinations. Values above the maximum become the maximum. Values below the minimum become the minimum. The package exists so gosec G115 analysis passes without sprinkling if branches at every narrowing conversion.

Saturating conversions

Each function has the form FromTo(n From) To and returns a clamped value. None panic and none allocate.

From int

From int64

From int32

From int16

From uint64

From uint32

From uint16

From rune

Must-variants (panic on overflow)

Use only when overflow is genuinely impossible at the call site (and you want a fast crash if that assumption ever breaks).

Generic conversion

type integer interface {
    ~int | ~int8 | ~int16 | ~int32 | ~int64 |
    ~uint | ~uint8 | ~uint16 | ~uint32 | ~uint64 | ~uintptr
}

func ToUint64[T integer](n T) uint64

Saturating cast from any integer-kind type to uint64. Prefer the typed functions above where the source type is statically known. The generic exists for libraries that accept any integer-kind input.

Semantics

• Negative to unsigned: returns 0.
• Above destination max: returns destination max.
• Below destination min (signed targets): returns destination min.
• Never panics (except the Must* variants), never truncates silently, never allocates.

See also

• Source: wdk/safeconv/safeconv.go.