{"record":{"id":"62740e223a2651bc","repo":"golang/go","slug":"bytes-repeat-output-length-overflow","errorCode":null,"errorMessage":"bytes: Repeat output length overflow","messagePattern":"bytes: Repeat output length overflow","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/bytes/bytes.go","lineNumber":643,"sourceCode":"\n// Repeat returns a new byte slice consisting of count copies of b.\n//\n// It panics if count is negative or if the result of (len(b) * count)\n// overflows.\nfunc Repeat(b []byte, count int) []byte {\n\tif count == 0 {\n\t\treturn []byte{}\n\t}\n\n\t// Since we cannot return an error on overflow,\n\t// we should panic if the repeat will generate an overflow.\n\t// See golang.org/issue/16237.\n\tif count < 0 {\n\t\tpanic(\"bytes: negative Repeat count\")\n\t}\n\thi, lo := bits.Mul(uint(len(b)), uint(count))\n\tif hi > 0 || lo > uint(maxInt) {\n\t\tpanic(\"bytes: Repeat output length overflow\")\n\t}\n\tn := int(lo) // lo = len(b) * count\n\n\tif len(b) == 0 {\n\t\treturn []byte{}\n\t}\n\n\t// Past a certain chunk size it is counterproductive to use\n\t// larger chunks as the source of the write, as when the source\n\t// is too large we are basically just thrashing the CPU D-cache.\n\t// So if the result length is larger than an empirically-found\n\t// limit (8KB), we stop growing the source string once the limit\n\t// is reached and keep reusing the same source string - that\n\t// should therefore be always resident in the L1 cache - until we\n\t// have completed the construction of the result.\n\t// This yields significant speedups (up to +100%) in cases where\n\t// the result length is large (roughly, over L2 cache size).\n\tconst chunkLimit = 8 * 1024","sourceCodeStart":625,"sourceCodeEnd":661,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/bytes/bytes.go#L625-L661","documentation":"bytes.Repeat computes the output length via a full 128-bit multiplication: hi, lo := bits.Mul(uint(len(b)), uint(count)). It panics with \"bytes: Repeat output length overflow\" when hi > 0 (the product exceeds 64 bits) OR lo > uint(maxInt) (the product exceeds the addressable int range). This catches both true 64-bit overflow and the platform-specific maxInt ceiling; it is the guard that the count<0 check cannot cover.","triggerScenarios":"Calling bytes.Repeat(b, count) where len(b)*count overflows: large input slice with a large count, or a moderately sized pattern repeated to fill a huge target; computing count from a desired output length without checking that len(b)*count fits; attacker-controlled count paired with a non-trivial pattern.","commonSituations":"Generating alignment/padding from a pattern to a target size expressed in bytes; replicating a template block a computed number of times; building a repeating key/keystream of a requested length; fuzz/test inputs that scale count to extreme values.","solutions":["Cap the desired output length and derive count from it: if len(b) == 0 handle separately, else count = min(desiredLen/len(b), maxCount) with an explicit upper bound.","Before calling Repeat, check the product fits: if uint(len(b)) > maxInt/uint(count) (with count>0), reject or reduce.","For huge outputs, write repetitions to an io.Writer in a loop rather than materializing one slice."],"exampleFix":"// before\nout := bytes.Repeat(pattern, count) // len(pattern)*count may overflow\n\n// after\nif len(pattern) == 0 {\n    out = []byte{}\n} else if count < 0 {\n    panic(\"negative count\")\n} else if uint(len(pattern)) > uint(maxInt)/uint(count) {\n    return fmt.Errorf(\"repeat output too large\")\n} else {\n    out = bytes.Repeat(pattern, count)\n}","handlingStrategy":"validation","validationCode":"// Guard the len(b)*count multiplication before Repeat.\nfunc safeRepeatLen(b []byte, count int) ([]byte, error) {\n    if count < 0 {\n        return nil, fmt.Errorf(\"negative repeat count\")\n    }\n    if len(b) == 0 {\n        return []byte{}, nil\n    }\n    if uint(len(b)) > uint(maxInt)/uint(count) {\n        return nil, fmt.Errorf(\"repeat output length overflow\")\n    }\n    return bytes.Repeat(b, count), nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Cap the desired output length and derive count from it: count = desiredLen/len(b).","For huge outputs, write repetitions to an io.Writer in a loop instead of one allocation.","Always combine the count<0 check with the multiplication-overflow check; they guard different failures."],"tags":["bytes","repeat","overflow","panic","go","multiplication"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}