{"record":{"id":"7f84a6d7272c8fba","repo":"valyala/fasthttp","slug":"too-long-int","errorCode":null,"errorMessage":"too long int","messagePattern":"too long int","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"bytesconv.go","lineNumber":279,"sourceCode":"// ParseUint parses uint from buf.\n//\n// A value too large for an int is an error rather than a wrapped result, so\n// ParseUint accepts exactly the unsigned decimal strings whose value fits in an\n// int on the current platform.\nfunc ParseUint(buf []byte) (int, error) {\n\tv, n, err := parseUintBuf(buf)\n\tif n != len(buf) {\n\t\treturn -1, errUnexpectedTrailingChar\n\t}\n\treturn v, err\n}\n\nvar (\n\terrEmptyInt               = errors.New(\"empty integer\")\n\terrIPv4PartTooLarge       = errors.New(\"ip part cannot exceed 255\")\n\terrUnexpectedFirstChar    = errors.New(\"unexpected first char found: expecting 0-9\")\n\terrUnexpectedTrailingChar = errors.New(\"unexpected trailing char found: expecting 0-9\")\n\terrTooLongInt             = errors.New(\"too long int\")\n)\n\nconst (\n\t// maxIntDiv10 is the largest accumulator that can still take another digit.\n\t// Anything above it overflows an int when multiplied by 10.\n\tmaxIntDiv10 = math.MaxInt / 10\n\n\t// maxSafeIntDigits is how many leading decimal digits can never overflow an\n\t// int, whatever the word size: 10**18-1 fits a 64-bit int and 10**9-1 fits a\n\t// 32-bit one. Go defines strconv.IntSize as 32 or 64 and nothing else.\n\t// TestMaxSafeIntDigits checks both halves of that claim on the build's own\n\t// int size.\n\tmaxSafeIntDigits = 9 * (strconv.IntSize / 32)\n)\n\nfunc parseUintBuf(b []byte) (int, int, error) {\n\tif len(b) == 0 {\n\t\treturn -1, 0, errEmptyInt","sourceCodeStart":261,"sourceCodeEnd":297,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/bytesconv.go#L261-L297","documentation":"errTooLongInt is returned by parseUintBuf when the numeric value overflows the platform int (checked via maxIntDiv10 = math.MaxInt/10 during accumulation). The library parses into machine ints, so values beyond math.MaxInt (or the 64-bit limit) cannot be represented. This protects against integer overflow from hostile input.","triggerScenarios":"ParseUint with 20+ digit numbers like \"99999999999999999999\"; Content-Length or Args.GetUint values crafted to overflow; parseIPv4Octet with extremely long octet strings.","commonSituations":"Malicious requests with absurdly long numeric fields (DoS/overflow probes); copy-paste errors in config; accepting unbounded user input as sizes or timeouts.","solutions":["Cap the input length (e.g. reject len(buf) > 18) before parsing when the semantic range is known.","After a successful parse, range-check the result against your domain limit (max body size, max timeout) and reject out-of-range values.","Treat this error from untrusted input as a 400 response and log the client for probing.","If you legitimately need big numbers, parse with math/big or uint64 via strconv.ParseUint instead of fasthttp's int-based parser."],"exampleFix":"// before\nn, err := fasthttp.ParseUint(userLen)\n// after\nn, err := fasthttp.ParseUint(userLen)\nif err != nil || n < 0 || n > maxAllowedSize {\n    return http.StatusBadRequest\n}","handlingStrategy":"validation","validationCode":"const maxReasonable = 1 << 30\nfunc parseUintBounded(b []byte, max int) (int, error) {\n    if len(b) > 18 { // int64 max has 19 digits; reject early\n        return 0, errors.New(\"number too large\")\n    }\n    n, err := fasthttp.ParseUint(b)\n    if err != nil {\n        return 0, err\n    }\n    if n > max {\n        return 0, fmt.Errorf(\"value %d exceeds limit %d\", n, max)\n    }\n    return n, nil\n}","typeGuard":"func safeUintLen(b []byte) bool { return len(b) <= 18 }","tryCatchPattern":"n, err := fasthttp.ParseUint(b)\nif err != nil && err.Error() == \"too long int\" {\n    return 0, errors.New(\"numeric value out of range\")\n}","preventionTips":["Bound input length before parsing untrusted numbers","Range-check parsed values against domain limits","Log and 400-reject overflow attempts from clients","Use strconv.ParseUint for values needing full uint64 range"],"tags":["integer-parsing","overflow","input-validation"],"backgroundTag":"integer-overflow","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}