Repository: securego/gosec (language: go)

Issue:
G109 tells the location at strconv.Atoi instead of strconv.Atoi result conversion to int16/32
### Summary

G109 tells the location at strconv.Atoi instead of strconv.Atoi result conversion to int16/32. Details can be seen [here](https://github.com/securego/gosec/issues/736#issuecomment-995457511)

### Steps to reproduce the behavior

```go
package main

import (
    "fmt"
    "strconv"
)

func main() {
    a, err := strconv.Atoi("a")
    b := int32(a)
    fmt.Println(b, err)
}
```

- If we add `#nosec G109` for `a, err := strconv.Atoi("a")`, we still get the error, which tell us it happens on this line.
- If we add `#nosec G109` for `b := int32(a)`, we will pass the check.

### gosec version

v2.9.3 & v2.9.5

### Go version (output of 'go version')

go1.16.10 linux/amd64 & go1.17.1 windows/amd64

### Operating system / Environment

Ubuntu & Win11

### Expected behavior

Rule G109 tells the location of strconv.Atoi result conversion to int16/32.

### Actual behavior

Rule G109 tells the location of strconv.Atoi.



Discussion / hints:

Fix patch:
diff --git a/rules/integer_overflow.go b/rules/integer_overflow.go
index dfcda94a8f..f55211a923 100644
--- a/rules/integer_overflow.go
+++ b/rules/integer_overflow.go
@@ -61,7 +61,7 @@ func (i *integerOverflowCheck) Match(node ast.Node, ctx *gosec.Context) (*gosec.
 		if fun, ok := n.Fun.(*ast.Ident); ok {
 			if fun.Name == "int32" || fun.Name == "int16" {
 				if idt, ok := n.Args[0].(*ast.Ident); ok {
-					if n, ok := atoiVarObj[idt.Obj]; ok {
+					if _, ok := atoiVarObj[idt.Obj]; ok {
 						// Detect int32(v) and int16(v)
 						return gosec.NewIssue(ctx, n, i.ID(), i.What, i.Severity, i.Confidence), nil
 					}


Test patch:
diff --git a/testutils/source.go b/testutils/source.go
index e42de500c0..60ff25ed46 100644
--- a/testutils/source.go
+++ b/testutils/source.go
@@ -795,7 +795,8 @@ func main() {
 	}
 	value := int32(bigValue)
 	fmt.Println(value)
-}`}, 1, gosec.NewConfig()}, {[]string{`
+}`}, 1, gosec.NewConfig()},
+		{[]string{`
 package main
 
 import (
@@ -811,7 +812,8 @@ func main() {
 	if int16(bigValue) < 0 {
 		fmt.Println(bigValue)
 	}
-}`}, 1, gosec.NewConfig()}, {[]string{`
+}`}, 1, gosec.NewConfig()},
+		{[]string{`
 package main
 
 import (
@@ -825,7 +827,8 @@ func main() {
 		panic(err)
 	}
 	fmt.Println(bigValue)
-}`}, 0, gosec.NewConfig()}, {[]string{`
+}`}, 0, gosec.NewConfig()},
+		{[]string{`
 package main
 
 import (
@@ -846,7 +849,8 @@ func test() {
 	bigValue := 30
 	value := int32(bigValue)
 	fmt.Println(value)
-}`}, 0, gosec.NewConfig()}, {[]string{`
+}`}, 0, gosec.NewConfig()},
+		{[]string{`
 package main
 
 import (
@@ -862,6 +866,17 @@ func main() {
 	}
 	v := int32(value)
 	fmt.Println(v)
+}`}, 0, gosec.NewConfig()},
+		{[]string{`
+package main
+import (
+    "fmt"
+    "strconv"
+)
+func main() {
+    a, err := strconv.Atoi("a")
+    b := int32(a) //#nosec G109
+    fmt.Println(b, err)
 }`}, 0, gosec.NewConfig()},
 	}