{"record":{"id":"b29c8e10b4a16178","repo":"gravitational/teleport","slug":"proto-createprivilegetokenrequest-wiretype-end-g","errorCode":null,"errorMessage":"proto: CreatePrivilegeTokenRequest: wiretype end group for non-group","messagePattern":"proto: CreatePrivilegeTokenRequest: wiretype end group for non-group","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/client/proto/authservice.pb.go","lineNumber":60418,"sourceCode":"\t\tvar wire uint64\n\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\tif shift >= 64 {\n\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t}\n\t\t\tif iNdEx >= l {\n\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t}\n\t\t\tb := dAtA[iNdEx]\n\t\t\tiNdEx++\n\t\t\twire |= uint64(b&0x7F) << shift\n\t\t\tif b < 0x80 {\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tfieldNum := int32(wire >> 3)\n\t\twireType := int(wire & 0x7)\n\t\tif wireType == 4 {\n\t\t\treturn fmt.Errorf(\"proto: CreatePrivilegeTokenRequest: wiretype end group for non-group\")\n\t\t}\n\t\tif fieldNum <= 0 {\n\t\t\treturn fmt.Errorf(\"proto: CreatePrivilegeTokenRequest: illegal tag %d (wire type %d)\", fieldNum, wire)\n\t\t}\n\t\tswitch fieldNum {\n\t\tcase 1:\n\t\t\tif wireType != 2 {\n\t\t\t\treturn fmt.Errorf(\"proto: wrong wireType = %d for field ExistingMFAResponse\", wireType)\n\t\t\t}\n\t\t\tvar msglen int\n\t\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\t\tif shift >= 64 {\n\t\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t\t}\n\t\t\t\tif iNdEx >= l {\n\t\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t\t}\n\t\t\t\tb := dAtA[iNdEx]","sourceCodeStart":60400,"sourceCodeEnd":60436,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/client/proto/authservice.pb.go#L60400-L60436","documentation":"Wire type 4 (END_GROUP) can only appear as the terminator of an embedded group started with wire type 3 (START_GROUP). The generated Unmarshal for CreatePrivilegeTokenRequest hit an END_GROUP byte with no matching start, so it rejects the payload as structurally invalid. Groups are deprecated proto2 constructs that this schema does not use at all, so such bytes are always invalid here.","triggerScenarios":"Bytes passed to CreatePrivilegeTokenRequest Unmarshal contain a tag whose low 3 bits equal 4 — i.e. a stray 0x??4 tag byte — due to corruption, offset desync, or an encoder emitting group markers.","commonSituations":"A byte-stream desync (parsing in the middle of a larger buffer instead of at a message boundary); corruption over a broken transport; a custom/fuzz encoder emitting proto2 group syntax; decoding the wrong message type's bytes.","solutions":["Unmarshal from a message boundary — make sure you pass exactly one marshaled message, not a slice of a stream","Confirm both peers use matching api/client/proto generated code","Check transport integrity (TLS, framing) for truncation/corruption","Regenerate the payload with proto.Marshal instead of reusing hand-built bytes"],"exampleFix":"// before: slicing a stream at a wrong offset\nerr := proto.Unmarshal(streamBuf[7:], req) // offset lands on a stray byte\n// after: use a length-delimited framing reader\nvar l uint64\nbuf = binary.Uvarint... // read length prefix, then Unmarshal exactly l bytes","handlingStrategy":"try-catch","validationCode":"func startsWithValidTag(b []byte) bool {\n    if len(b) == 0 { return false }\n    tag, n := binary.Uvarint(b)\n    return n > 0 && tag>>3 >= 1 && tag&0x7 != 4\n}","typeGuard":"func isMalformedWireData(err error) bool {\n    return err != nil && (strings.Contains(err.Error(), \"end group for non-group\") || strings.Contains(err.Error(), \"illegal tag\"))\n}","tryCatchPattern":"if err := proto.Unmarshal(buf, req); err != nil {\n    if isMalformedWireData(err) {\n        return trace.BadParameter(\"payload is not a valid CreatePrivilegeTokenRequest; check framing\")\n    }\n    return trace.Wrap(err)\n}","preventionTips":["Unmarshal only from verified message boundaries with length-prefix framing","Verify transport integrity (TLS, no frame-rewriting proxies)","Replace hand-built byte fixtures with proto.Marshal output","Reject zero-padded/truncated buffers before decoding"],"tags":["protobuf","wire-format","malformed-data","deserialization"],"backgroundTag":"proto-malformed-wire-data","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}