{"record":{"id":"a8795df8784913f1","repo":"gravitational/teleport","slug":"proto-passwordless-wiretype-end-group-for-non-gr","errorCode":null,"errorMessage":"proto: Passwordless: wiretype end group for non-group","messagePattern":"proto: Passwordless: wiretype end group for non-group","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/client/proto/authservice.pb.go","lineNumber":59979,"sourceCode":"\t\tvar wire uint64\n\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\tif shift >= 64 {\n\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t}\n\t\t\tif iNdEx >= l {\n\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t}\n\t\t\tb := dAtA[iNdEx]\n\t\t\tiNdEx++\n\t\t\twire |= uint64(b&0x7F) << shift\n\t\t\tif b < 0x80 {\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tfieldNum := int32(wire >> 3)\n\t\twireType := int(wire & 0x7)\n\t\tif wireType == 4 {\n\t\t\treturn fmt.Errorf(\"proto: Passwordless: wiretype end group for non-group\")\n\t\t}\n\t\tif fieldNum <= 0 {\n\t\t\treturn fmt.Errorf(\"proto: Passwordless: illegal tag %d (wire type %d)\", fieldNum, wire)\n\t\t}\n\t\tswitch fieldNum {\n\t\tdefault:\n\t\t\tiNdEx = preIndex\n\t\t\tskippy, err := skipAuthservice(dAtA[iNdEx:])\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tif (skippy < 0) || (iNdEx+skippy) < 0 {\n\t\t\t\treturn ErrInvalidLengthAuthservice\n\t\t\t}\n\t\t\tif (iNdEx + skippy) > l {\n\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t}\n\t\t\tm.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)","sourceCodeStart":59961,"sourceCodeEnd":59997,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/client/proto/authservice.pb.go#L59961-L59997","documentation":"This error is thrown by the gogo/protobuf-generated Unmarshal code for the Passwordless message in api/client/proto/authservice.pb.go. During binary protobuf decoding, if a field declares wire type 4 (end-group), which is only valid inside packed groups (deprecated), the decoder rejects it because Passwordless contains no group fields. It indicates the byte stream being decoded is not a valid encoding of the Passwordless message.","triggerScenarios":"Calling Unmarshal (directly or via gRPC) on bytes whose next wire tag has wireType==4 for the Passwordless message — i.e. corrupted, truncated-shifted, or non-protobuf bytes, or bytes of a different message type decoded as Passwordless.","commonSituations":"Version skew between client and server where one side changed field types; manually concatenating or slicing serialized messages; sending JSON/other bytes to a gRPC endpoint; reading a corrupted payload from a queue or file.","solutions":["Verify the bytes being unmarshaled were produced by Marshal of a Passwordless message and not truncated or offset","Regenerate/rebuild both client and server from the same proto definitions to eliminate version skew","Check that the transport is delivering raw protobuf, not base64/JSON-encoded data","Log the raw payload (hex) and validate it with protoc --decode_raw to find the malformed field"],"exampleFix":"// before\nvar p proto.Passwordless\nif err := p.Unmarshal(someOtherMessageBytes); err != nil { ... }\n// after\nvar p proto.Passwordless\nif err := p.Unmarshal(passwordlessBytes); err != nil { return trace.Wrap(err) }","handlingStrategy":"try-catch","validationCode":"if len(payload) == 0 { return errors.New(\"empty payload\") }\n// optionally pre-check first wire byte: tag&0x7 != 4\nif payload[0]&0x7 == 4 { return errors.New(\"invalid wire type (end group)\") }","typeGuard":"func looksLikeProto(b []byte) bool {\n  return len(b) > 0 && b[0] != 0 && b[0]&0x7 != 4 && b[0]&0x7 != 3\n}","tryCatchPattern":"var p proto.Passwordless\nif err := proto.Unmarshal(payload, &p); err != nil {\n  return trace.BadParameter(\"invalid Passwordless payload: %v\", err)\n}","preventionTips":["Always round-trip through Marshal from generated structs, never hand-built bytes","Keep client and server proto/generated code versions in lockstep","Log payload length (and hex sample) on decode failure for diagnosis","Validate unknown external payloads with protoc --decode_raw before Unmarshal"],"tags":["protobuf","grpc","deserialization","wire-format"],"backgroundTag":"protobuf-unmarshal-failed","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}