{"record":{"id":"9b1e7242b5ee02f3","repo":"gravitational/teleport","slug":"proto-createregisterchallengerequest-illegal-tag","errorCode":null,"errorMessage":"proto: CreateRegisterChallengeRequest: illegal tag %d (wire type %d)","messagePattern":"proto: CreateRegisterChallengeRequest: illegal tag (.+?) \\(wire type (.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/client/proto/authservice.pb.go","lineNumber":60508,"sourceCode":"\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t}\n\t\t\tif iNdEx >= l {\n\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t}\n\t\t\tb := dAtA[iNdEx]\n\t\t\tiNdEx++\n\t\t\twire |= uint64(b&0x7F) << shift\n\t\t\tif b < 0x80 {\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tfieldNum := int32(wire >> 3)\n\t\twireType := int(wire & 0x7)\n\t\tif wireType == 4 {\n\t\t\treturn fmt.Errorf(\"proto: CreateRegisterChallengeRequest: wiretype end group for non-group\")\n\t\t}\n\t\tif fieldNum <= 0 {\n\t\t\treturn fmt.Errorf(\"proto: CreateRegisterChallengeRequest: illegal tag %d (wire type %d)\", fieldNum, wire)\n\t\t}\n\t\tswitch fieldNum {\n\t\tcase 1:\n\t\t\tif wireType != 2 {\n\t\t\t\treturn fmt.Errorf(\"proto: wrong wireType = %d for field TokenID\", wireType)\n\t\t\t}\n\t\t\tvar stringLen uint64\n\t\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\t\tif shift >= 64 {\n\t\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t\t}\n\t\t\t\tif iNdEx >= l {\n\t\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t\t}\n\t\t\t\tb := dAtA[iNdEx]\n\t\t\t\tiNdEx++\n\t\t\t\tstringLen |= uint64(b&0x7F) << shift\n\t\t\t\tif b < 0x80 {","sourceCodeStart":60490,"sourceCodeEnd":60526,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/client/proto/authservice.pb.go#L60490-L60526","documentation":"A tag with a non-positive field number (e.g. 0x00, field 0) appeared while decoding CreateRegisterChallengeRequest. Valid protobuf tags always have field number >= 1, so the generated Unmarshal rejects the payload with this error, embedding the raw tag and wire type for diagnosis.","triggerScenarios":"Unmarshaling corrupted, zero-filled, or misaligned bytes where the next tag decodes to field number 0 — e.g. an empty padding region, wrong stream offset, or bytes of a different message type.","commonSituations":"Zero-initialized buffers passed as payloads; off-by-one stream framing; fuzz inputs; mismatched message types between producer and consumer in register-challenge flows.","solutions":["Check the buffer for leading zero bytes and trim/align to the real message start","Confirm the producer marshals CreateRegisterChallengeRequest with a matching schema version","Add length-prefix framing so offsets cannot drift","Validate with protoc --decode_raw when debugging third-party producers"],"exampleFix":"// before\npayload := make([]byte, 64) // copied into, rest zeros\nproto.Unmarshal(payload, req)\n// after\npayload = payload[:bytesWritten]\nerr := proto.Unmarshal(payload, req)","handlingStrategy":"validation","validationCode":"func noLeadingZeros(b []byte) error {\n    if len(b) == 0 { return errors.New(\"empty payload\") }\n    if b[0] == 0x00 { return errors.New(\"leading zero tag: buffer misaligned or zero-padded\") }\n    return nil\n}","typeGuard":"func isIllegalTagError(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"illegal tag\")\n}","tryCatchPattern":"if err := proto.Unmarshal(payload, req); err != nil {\n    if isIllegalTagError(err) {\n        return trace.BadParameter(\"payload corrupt: invalid leading tag\")\n    }\n    return trace.Wrap(err)\n}","preventionTips":["Copy buffers with payload[:n] instead of fixed-size zeroed arrays","Add length-prefix framing to prevent offset drift","Verify the message type matches between producer and consumer","Check incoming payloads for zero padding before decode"],"tags":["protobuf","wire-format","malformed-data","deserialization"],"backgroundTag":"proto-malformed-wire-data","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}