{"record":{"id":"8a131dba1a71921b","repo":"jackc/pgx","slug":"invalid-saslinitialresponse","errorCode":null,"errorMessage":"invalid SASLInitialResponse","messagePattern":"invalid SASLInitialResponse","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgproto3/sasl_initial_response.go","lineNumber":29,"sourceCode":"\ntype SASLInitialResponse struct {\n\tAuthMechanism string\n\tData          []byte\n}\n\n// Frontend identifies this message as sendable by a PostgreSQL frontend.\nfunc (*SASLInitialResponse) Frontend() {}\n\n// Decode decodes src into dst. src must contain the complete message with the exception of the initial 1 byte message\n// type identifier and 4 byte message length.\nfunc (dst *SASLInitialResponse) Decode(src []byte) error {\n\t*dst = SASLInitialResponse{}\n\n\trp := 0\n\n\tidx := bytes.IndexByte(src, 0)\n\tif idx < 0 {\n\t\treturn errors.New(\"invalid SASLInitialResponse\")\n\t}\n\n\tdst.AuthMechanism = string(src[rp:idx])\n\trp = idx + 1\n\n\tif len(src[rp:]) < 4 {\n\t\treturn errors.New(\"invalid SASLInitialResponse\")\n\t}\n\trp += 4 // The rest of the message is data so we can just skip the size\n\tdst.Data = src[rp:]\n\n\treturn nil\n}\n\n// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.\nfunc (src *SASLInitialResponse) Encode(dst []byte) ([]byte, error) {\n\tdst, sp := beginMessage(dst, 'p')\n","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgproto3/sasl_initial_response.go#L11-L47","documentation":"Decode of a SASLInitialResponse frontend message could not find a NUL terminator for the auth mechanism name in the message body. The PostgreSQL wire protocol requires the mechanism string to be NUL-terminated; a truncated or malformed frame triggers this guard in pgproto3 decoding.","triggerScenarios":"Thrown at pgproto3/sasl_initial_response.go:29 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the client library sending the SASLInitialResponse frames the mechanism string with a trailing zero byte","Check for truncation or corruption of the message buffer passed to Decode","Capture the raw bytes and compare against a known-good SASLInitialResponse encoding"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}