{"record":{"id":"a8ac71ca94818a27","repo":"apache/cassandra","slug":"value","errorCode":null,"errorMessage":"${value}","messagePattern":"\\$\\{value\\}","errorType":"exception","errorClass":"VIntOutOfRangeException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/utils/vint/VIntCoding.java","lineNumber":679,"sourceCode":"    /** Compute the number of bytes that would be needed to encode a varint. */\n    public static int computeVIntSize(final long param)\n    {\n        return computeUnsignedVIntSize(encodeZigZag64(param));\n    }\n\n    /** Compute the number of bytes that would be needed to encode an unsigned varint. */\n    public static int computeUnsignedVIntSize(final long value)\n    {\n        int magnitude = Long.numberOfLeadingZeros(value | 1); // | with 1 to ensure magntiude <= 63, so (63 - 1) / 7 <= 8\n        // the formula below is hand-picked to match the original 9 - ((magnitude - 1) / 7)\n        return (639 - magnitude * 9) >> 6;\n    }\n\n    public static int checkedCast(long value)\n    {\n        int result = (int)value;\n        if ((long)result != value)\n            throw new VIntOutOfRangeException(value);\n        return result;\n    }\n}\n","sourceCodeStart":661,"sourceCodeEnd":683,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/utils/vint/VIntCoding.java#L661-L683","documentation":"VIntCoding.checkedCast(long) casts a long to int and verifies the value round-trips; if the long does not fit in 32 bits it throws VIntOutOfRangeException carrying the value. It mirrors Guava's Ints.checkedCast for varint-encoded quantities that must be int-sized.","triggerScenarios":"Calling VIntCoding.checkedCast with a value > Integer.MAX_VALUE or < Integer.MIN_VALUE, e.g. an untrusted peer sends a huge varint length that is then checked-cast before allocation.","commonSituations":"Malicious or corrupted incoming protocol messages declaring sizes beyond int range; parsing 64-bit varints and assuming 32-bit values; version mismatches between sender and receiver.","solutions":["Catch VIntOutOfRangeException and treat the message as corrupt (close/flag the connection).","Range-check before casting: if (value < Integer.MIN_VALUE || value > Integer.MAX_VALUE) handle explicitly.","If 64 bits are genuinely needed, use the long value directly instead of checkedCast."],"exampleFix":"// before\nint len = VIntCoding.checkedCast(sizeLong);\n// after\nif (sizeLong < 0 || sizeLong > Integer.MAX_VALUE) throw new CorruptFrameException(\"size out of int range: \" + sizeLong);\nint len = (int) sizeLong;","handlingStrategy":"try-catch","validationCode":"boolean fitsInt = value >= Integer.MIN_VALUE && value <= Integer.MAX_VALUE;","typeGuard":null,"tryCatchPattern":"try { int v = VIntCoding.checkedCast(value); } catch (VIntOutOfRangeException e) { throw new CorruptFrameException(\"varint out of int range: \" + e.getMessage()); }","preventionTips":["Range-check untrusted varint-decoded lengths before casting to int.","Keep values as long when the domain is 64-bit.","Apply sanity limits (e.g. max frame size) on peer-supplied sizes."],"tags":["vint","overflow","serialization","java"],"backgroundTag":"value-out-of-range","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}