{"record":{"id":"50c7c2d0aa7d5db8","repo":"gravitational/teleport","slug":"proto-identitycenteraccount-wiretype-end-group-f","errorCode":null,"errorMessage":"proto: IdentityCenterAccount: wiretype end group for non-group","messagePattern":"proto: IdentityCenterAccount: wiretype end group for non-group","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/client/proto/authservice.pb.go","lineNumber":60662,"sourceCode":"\t\tvar wire uint64\n\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\tif shift >= 64 {\n\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t}\n\t\t\tif iNdEx >= l {\n\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t}\n\t\t\tb := dAtA[iNdEx]\n\t\t\tiNdEx++\n\t\t\twire |= uint64(b&0x7F) << shift\n\t\t\tif b < 0x80 {\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tfieldNum := int32(wire >> 3)\n\t\twireType := int(wire & 0x7)\n\t\tif wireType == 4 {\n\t\t\treturn fmt.Errorf(\"proto: IdentityCenterAccount: wiretype end group for non-group\")\n\t\t}\n\t\tif fieldNum <= 0 {\n\t\t\treturn fmt.Errorf(\"proto: IdentityCenterAccount: illegal tag %d (wire type %d)\", fieldNum, wire)\n\t\t}\n\t\tswitch fieldNum {\n\t\tcase 1:\n\t\t\tif wireType != 2 {\n\t\t\t\treturn fmt.Errorf(\"proto: wrong wireType = %d for field ID\", wireType)\n\t\t\t}\n\t\t\tvar stringLen uint64\n\t\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\t\tif shift >= 64 {\n\t\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t\t}\n\t\t\t\tif iNdEx >= l {\n\t\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t\t}\n\t\t\t\tb := dAtA[iNdEx]","sourceCodeStart":60644,"sourceCodeEnd":60680,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/client/proto/authservice.pb.go#L60644-L60680","documentation":"Protobuf groups (wire type 4 = end-group) are a legacy proto2 construct; this message's fields are not groups, so seeing an end-group wire type inside IdentityCenterAccount means the byte stream is structurally invalid or from an incompatible schema. The generated Unmarshal rejects it immediately as a framing sanity check.","triggerScenarios":"Decoding an IdentityCenterAccount (AWS Identity Center account listing in the Auth Service) whose field tag encodes wire type 4 — caused by corrupted bytes, offset misalignment (parsing a sub-slice starting mid-record), or a non-proto payload fed to proto.Unmarshal.","commonSituations":"Slicing stored protobuf data at wrong byte offsets, feeding JSON/other binary to a proto decoder, fuzzing, or truncation during persistence that shifted field boundaries.","solutions":["Verify you are unmarshaling the complete, correctly offset protobuf message (not a sub-slice).","Confirm the payload is actually protobuf (e.g. marshal a fresh IdentityCenterAccount and compare the tag bytes).","Upgrade both producer and consumer to the same Teleport version.","Regenerate pb.go files from the current .proto if fields were edited."],"exampleFix":"// before: passing a mid-buffer slice\ndata := blob[offset:] // offset from stale index\nproto.Unmarshal(data, &acct)\n// after: read the full record with its length prefix\nrec := readLengthPrefixed(blob) // exact frame\nproto.Unmarshal(rec, &acct)","handlingStrategy":"validation","validationCode":"func validateIdentityCenterAccountFrame(data []byte) error {\n  if len(data) == 0 { return errors.New(\"empty payload\") }\n  key, n := binary.Uvarint(data)\n  if n <= 0 { return errors.New(\"truncated tag\") }\n  if int(key)&0x7 == 4 { return errors.New(\"end-group wire type: misaligned or foreign payload\") }\n  if int(key)>>3 <= 0 { return errors.New(\"illegal field number\") }\n  return nil\n}","typeGuard":null,"tryCatchPattern":"if err := proto.Unmarshal(data, &acct); err != nil {\n  if strings.Contains(err.Error(), \"end group for non-group\") {\n    log.Warn(\"corrupt/misaligned IdentityCenterAccount bytes; resync required\")\n  }\n  return err\n}","preventionTips":["Always store/transfer protobuf with a length prefix so records cannot be sliced mid-frame.","Validate framing (first tag byte) before unmarshaling stored records.","Refuse payloads written by unknown schema versions (store a version header).","Watch for this error under fuzz/chaos tests as a framing bug signal."],"tags":["protobuf","grpc","wire-format","data-corruption","teleport"],"backgroundTag":"protobuf-wire-type-mismatch","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}