{"record":{"id":"70622385710e77f4","repo":"gravitational/teleport","slug":"proto-identitycenterpermissionset-wiretype-end-g","errorCode":null,"errorMessage":"proto: IdentityCenterPermissionSet: wiretype end group for non-group","messagePattern":"proto: IdentityCenterPermissionSet: wiretype end group for non-group","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/client/proto/authservice.pb.go","lineNumber":60841,"sourceCode":"\t\tvar wire uint64\n\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\tif shift >= 64 {\n\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t}\n\t\t\tif iNdEx >= l {\n\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t}\n\t\t\tb := dAtA[iNdEx]\n\t\t\tiNdEx++\n\t\t\twire |= uint64(b&0x7F) << shift\n\t\t\tif b < 0x80 {\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tfieldNum := int32(wire >> 3)\n\t\twireType := int(wire & 0x7)\n\t\tif wireType == 4 {\n\t\t\treturn fmt.Errorf(\"proto: IdentityCenterPermissionSet: wiretype end group for non-group\")\n\t\t}\n\t\tif fieldNum <= 0 {\n\t\t\treturn fmt.Errorf(\"proto: IdentityCenterPermissionSet: illegal tag %d (wire type %d)\", fieldNum, wire)\n\t\t}\n\t\tswitch fieldNum {\n\t\tcase 1:\n\t\t\tif wireType != 2 {\n\t\t\t\treturn fmt.Errorf(\"proto: wrong wireType = %d for field ARN\", wireType)\n\t\t\t}\n\t\t\tvar stringLen uint64\n\t\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\t\tif shift >= 64 {\n\t\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t\t}\n\t\t\t\tif iNdEx >= l {\n\t\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t\t}\n\t\t\t\tb := dAtA[iNdEx]","sourceCodeStart":60823,"sourceCodeEnd":60859,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/client/proto/authservice.pb.go#L60823-L60859","documentation":"Same structural sanity check as error 133, but for IdentityCenterPermissionSet: an end-group wire type (4) was read for one of its fields, which cannot happen for a valid stream of this non-group message. It indicates invalid framing — corrupted, truncated, misaligned, or foreign bytes being handed to the Unmarshal routine.","triggerScenarios":"Decoding an IdentityCenterPermissionSet (AWS Identity Center permission set in the Auth Service) where a field key's wire type bits equal 4 — caused by parsing a sub-slice starting mid-record, corrupt storage bytes, or feeding non-proto data.","commonSituations":"Wrong offset/length when reading framed protobuf from disk or a queue, restoring data written by a different schema version, fuzz tests, misrouted binary payloads.","solutions":["Check the framing code: unmarshal exactly one length-prefixed record, starting at tag 0x0a (field 1, wire type 2).","Confirm the payload originates from the same Teleport schema version.","Regenerate pb.go if the message fields were recently changed.","Discard corrupted records and re-run the AWS Identity Center sync."],"exampleFix":"// before: resuming mid-record after a partial decode\nrest := buf[consumed:] // consumed counted wrong\nproto.Unmarshal(rest, &ps)\n// after: track offsets from Unmarshal's return\nconsumed, err := proto.Unmarshal(buf, &ps)\nrest := buf[consumed:]","handlingStrategy":"validation","validationCode":"func validatePermissionSetFrame(data []byte) error {\n  if len(data) == 0 { return errors.New(\"empty payload\") }\n  key, n := binary.Uvarint(data)\n  if n <= 0 { return errors.New(\"unreadable tag\") }\n  if int(key)&0x7 == 4 { return errors.New(\"end-group byte: misaligned or corrupt frame\") }\n  if int(key) != 0x0a { return fmt.Errorf(\"unexpected first tag 0x%x; expected 0x0a\", key) }\n  return nil\n}","typeGuard":null,"tryCatchPattern":"if err := proto.Unmarshal(data, &ps); err != nil {\n  if strings.Contains(err.Error(), \"end group for non-group\") {\n    log.Warn(\"IdentityCenterPermissionSet frame corrupt; trigger re-sync\")\n  }\n  return err\n}","preventionTips":["Frame every stored/transferred protobuf record with an explicit length prefix.","Verify record boundaries (offsets) when resuming partial decodes.","Pin teleport/api versions across all components.","Add fuzz tests over the record-framing path to catch alignment bugs early."],"tags":["protobuf","grpc","wire-format","data-corruption","teleport"],"backgroundTag":"protobuf-wire-type-mismatch","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}