{"record":{"id":"a68bb7fedbe0e0c4","repo":"valyala/fasthttp","slug":"ip-part-cannot-exceed-255","errorCode":null,"errorMessage":"ip part cannot exceed 255","messagePattern":"ip part cannot exceed 255","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"bytesconv.go","lineNumber":276,"sourceCode":"\treturn strconv.AppendUint(dst, uint64(n), 10)\n}\n\n// ParseUint parses uint from buf.\n//\n// A value too large for an int is an error rather than a wrapped result, so\n// ParseUint accepts exactly the unsigned decimal strings whose value fits in an\n// int on the current platform.\nfunc ParseUint(buf []byte) (int, error) {\n\tv, n, err := parseUintBuf(buf)\n\tif n != len(buf) {\n\t\treturn -1, errUnexpectedTrailingChar\n\t}\n\treturn v, err\n}\n\nvar (\n\terrEmptyInt               = errors.New(\"empty integer\")\n\terrIPv4PartTooLarge       = errors.New(\"ip part cannot exceed 255\")\n\terrUnexpectedFirstChar    = errors.New(\"unexpected first char found: expecting 0-9\")\n\terrUnexpectedTrailingChar = errors.New(\"unexpected trailing char found: expecting 0-9\")\n\terrTooLongInt             = errors.New(\"too long int\")\n)\n\nconst (\n\t// maxIntDiv10 is the largest accumulator that can still take another digit.\n\t// Anything above it overflows an int when multiplied by 10.\n\tmaxIntDiv10 = math.MaxInt / 10\n\n\t// maxSafeIntDigits is how many leading decimal digits can never overflow an\n\t// int, whatever the word size: 10**18-1 fits a 64-bit int and 10**9-1 fits a\n\t// 32-bit one. Go defines strconv.IntSize as 32 or 64 and nothing else.\n\t// TestMaxSafeIntDigits checks both halves of that claim on the build's own\n\t// int size.\n\tmaxSafeIntDigits = 9 * (strconv.IntSize / 32)\n)\n","sourceCodeStart":258,"sourceCodeEnd":294,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/bytesconv.go#L258-L294","documentation":"errIPv4PartTooLarge is returned when an octet parsed during ParseIPv4 (or parseIPv4Octet) exceeds 255, which is impossible for a valid IPv4 address. Each of the four dot-separated parts must fit in one byte. The error indicates malformed IP input rather than a library fault.","triggerScenarios":"ParseIPv4(dst, []byte(\"256.1.1.1\")) or any address where a dot-separated component is >255 (also huge components like \"999999999999.1.1.1\").","commonSituations":"Typo'd or hand-crafted IPs in config files; untrusted user input passed as an IP; header values that contain port numbers, hostnames, or garbage instead of a dotted quad.","solutions":["Sanitize the input before parsing: split on '.' and verify each part is a number in 0..255, or pre-validate with net.ParseIP(string(ipStr)) != nil.","Return a 400 Bad Request when the value comes from user input, since it is client-supplied malformed data.","Strip a port suffix (e.g. '1.2.3.4:8080') before parsing — the ':8080' part makes parsing fail.","Trim whitespace and surrounding brackets from header values before parsing."],"exampleFix":"// before\nip, err := fasthttp.ParseIPv4(dst, []byte(userInput))\n// after\nif net.ParseIP(userInput) == nil {\n    return errors.New(\"invalid IPv4 address\")\n}\nip, err := fasthttp.ParseIPv4(dst, []byte(userInput))","handlingStrategy":"validation","validationCode":"func validIPv4(s string) bool {\n    ip := net.ParseIP(s)\n    return ip != nil && ip.To4() != nil\n}\n// call site\nif !validIPv4(string(b)) {\n    return errors.New(\"invalid IPv4 address\")\n}\n_, err := fasthttp.ParseIPv4(dst, b)","typeGuard":"func isIPv4Bytes(b []byte) bool {\n    ip := net.ParseIP(string(b))\n    return ip != nil && ip.To4() != nil\n}","tryCatchPattern":"ip, err := fasthttp.ParseIPv4(dst, b)\nif err != nil {\n    return fmt.Errorf(\"bad IPv4 %q: %w\", b, err) // includes 'ip part cannot exceed 255'\n}","preventionTips":["Pre-validate with net.ParseIP before fasthttp parsing","Strip ':port' and brackets from address strings first","Never feed raw user input to IP parsers without validation","Split on '.' and range-check octets for clear error messages"],"tags":["ip-parsing","input-validation","range-error"],"backgroundTag":"invalid-ip-address","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}