{"record":{"id":"23cbe9ecf0b34230","repo":"gravitational/teleport","slug":"proto-createprivilegetokenrequest-illegal-tag-d","errorCode":null,"errorMessage":"proto: CreatePrivilegeTokenRequest: illegal tag %d (wire type %d)","messagePattern":"proto: CreatePrivilegeTokenRequest: illegal tag (.+?) \\(wire type (.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/client/proto/authservice.pb.go","lineNumber":60421,"sourceCode":"\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t}\n\t\t\tif iNdEx >= l {\n\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t}\n\t\t\tb := dAtA[iNdEx]\n\t\t\tiNdEx++\n\t\t\twire |= uint64(b&0x7F) << shift\n\t\t\tif b < 0x80 {\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tfieldNum := int32(wire >> 3)\n\t\twireType := int(wire & 0x7)\n\t\tif wireType == 4 {\n\t\t\treturn fmt.Errorf(\"proto: CreatePrivilegeTokenRequest: wiretype end group for non-group\")\n\t\t}\n\t\tif fieldNum <= 0 {\n\t\t\treturn fmt.Errorf(\"proto: CreatePrivilegeTokenRequest: illegal tag %d (wire type %d)\", fieldNum, wire)\n\t\t}\n\t\tswitch fieldNum {\n\t\tcase 1:\n\t\t\tif wireType != 2 {\n\t\t\t\treturn fmt.Errorf(\"proto: wrong wireType = %d for field ExistingMFAResponse\", wireType)\n\t\t\t}\n\t\t\tvar msglen int\n\t\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\t\tif shift >= 64 {\n\t\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t\t}\n\t\t\t\tif iNdEx >= l {\n\t\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t\t}\n\t\t\t\tb := dAtA[iNdEx]\n\t\t\t\tiNdEx++\n\t\t\t\tmsglen |= int(b&0x7F) << shift\n\t\t\t\tif b < 0x80 {","sourceCodeStart":60403,"sourceCodeEnd":60439,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/client/proto/authservice.pb.go#L60403-L60439","documentation":"After reading a tag, the generated Unmarshal for CreatePrivilegeTokenRequest validates the field number (tag >> 3). A field number <= 0 is impossible in valid protobuf, so the decoder returns this formatted error including the raw tag and wire type. It means the bytes are not a valid CreatePrivilegeTokenRequest encoding.","triggerScenarios":"Unmarshaling bytes whose next tag has field number 0 (tag byte 0x00) or otherwise decodes to a non-positive field number — typical of zero-filled/corrupted buffers or wrong-offset parsing.","commonSituations":"Decoding zeroed memory or an empty-padded buffer; parsing from the wrong offset inside a stream; fuzz inputs; a producer marshaling a different message type whose bytes misalign here.","solutions":["Verify the buffer starts at a real message boundary and is non-empty/non-zero-padded","Confirm the sender marshals CreatePrivilegeTokenRequest (same type and schema version)","protoc --decode_raw the payload to see where the structure diverges","Add integrity checks (length prefixes, checksums) around framed payloads"],"exampleFix":"// before\nerr := proto.Unmarshal(zeroPaddedBuf, req)\n// after\nif len(buf) == 0 { return trace.BadParameter(\"empty payload\") }\nerr := proto.Unmarshal(buf, req)","handlingStrategy":"validation","validationCode":"func validLeadingTag(b []byte) error {\n    if len(b) == 0 { return errors.New(\"empty payload\") }\n    tag, n := binary.Uvarint(b)\n    if n <= 0 { return errors.New(\"undecodable leading tag\") }\n    if tag>>3 <= 0 { return fmt.Errorf(\"illegal field number %d in leading tag 0x%x\", tag>>3, tag) }\n    return nil\n}","typeGuard":"func isIllegalTagError(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"illegal tag\")\n}","tryCatchPattern":"if err := proto.Unmarshal(blob, req); err != nil {\n    if isIllegalTagError(err) {\n        return trace.BadParameter(\"corrupt or misaligned payload\")\n    }\n    return trace.Wrap(err)\n}","preventionTips":["Trim buffers to actual written length before unmarshal","Use framed, length-prefixed transports instead of raw slicing","Confirm producer and consumer decode the same message type","Add corruption checks (checksums) around persisted or relayed payloads"],"tags":["protobuf","wire-format","malformed-data","deserialization"],"backgroundTag":"proto-malformed-wire-data","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}