{"record":{"id":"d0a004d372d19f47","repo":"golang/go","slug":"crypto-sha512-invalid-hash-state-size","errorCode":null,"errorMessage":"crypto/sha512: invalid hash state size","messagePattern":"crypto/sha512: invalid hash state size","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/boring/sha.go","lineNumber":524,"sourceCode":"\tb = byteorder.BEAppendUint64(b, d.h[4])\n\tb = byteorder.BEAppendUint64(b, d.h[5])\n\tb = byteorder.BEAppendUint64(b, d.h[6])\n\tb = byteorder.BEAppendUint64(b, d.h[7])\n\tb = append(b, d.x[:d.nx]...)\n\tb = append(b, make([]byte, len(d.x)-int(d.nx))...)\n\tb = byteorder.BEAppendUint64(b, d.nl>>3|d.nh<<61)\n\treturn b, nil\n}\n\nfunc (h *sha384Hash) UnmarshalBinary(b []byte) error {\n\tif len(b) < len(magic512) {\n\t\treturn errors.New(\"crypto/sha512: invalid hash state identifier\")\n\t}\n\tif string(b[:len(magic384)]) != magic384 {\n\t\treturn errors.New(\"crypto/sha512: invalid hash state identifier\")\n\t}\n\tif len(b) != marshaledSize512 {\n\t\treturn errors.New(\"crypto/sha512: invalid hash state size\")\n\t}\n\td := (*sha512Ctx)(unsafe.Pointer(&h.ctx))\n\tb = b[len(magic512):]\n\tb, d.h[0] = consumeUint64(b)\n\tb, d.h[1] = consumeUint64(b)\n\tb, d.h[2] = consumeUint64(b)\n\tb, d.h[3] = consumeUint64(b)\n\tb, d.h[4] = consumeUint64(b)\n\tb, d.h[5] = consumeUint64(b)\n\tb, d.h[6] = consumeUint64(b)\n\tb, d.h[7] = consumeUint64(b)\n\tb = b[copy(d.x[:], b):]\n\tb, n := consumeUint64(b)\n\td.nl = n << 3\n\td.nh = n >> 61\n\td.nx = uint32(n) % 128\n\treturn nil\n}","sourceCodeStart":506,"sourceCodeEnd":542,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/boring/sha.go#L506-L542","documentation":"Returned by sha384Hash.UnmarshalBinary after both prefix checks pass but the total length is not marshaledSize512. Guards the fixed-shape decode that follows (8 uint64 state words, 128-byte block, 8-byte counter).","triggerScenarios":"Calling UnmarshalBinary on a sha512.New384() hash with a correctly-prefixed but wrong-length blob.","commonSituations":"Truncated/padded state; state from a different Go version whose marshalled layout changed; transport corruption.","solutions":["Validate length == marshaledSize512 before unmarshalling.","Regenerate the blob from the current Go build.","Re-hash instead of persisting state."],"exampleFix":"// before\nh := sha512.New384()\nh.(encoding.BinaryUnmarshalser).UnmarshalBinary(state)\n// after\nif len(state) != expectedLen512 { return errors.New(\"bad sha384 state size\") }\nh.(encoding.BinaryUnmarshalser).UnmarshalBinary(state)","handlingStrategy":"validation","validationCode":"// marshaledSize512 for the BoringCrypto SHA-512 build\nconst sha512MarshaledSize = 6 + 8*8 + 128 + 8 // = 206\nfunc validSHA384State(s []byte) bool {\n    return len(s) == sha512MarshaledSize\n}","typeGuard":"// n/a","tryCatchPattern":"if err := h384.(encoding.BinaryUnmarshalser).UnmarshalBinary(state); err != nil {\n    return err\n}","preventionTips":["Validate length together with the prefix.","Regenerate persisted blobs on Go upgrades.","Prefer re-hashing."],"tags":["crypto","sha512","sha384","boringcrypto","serialization","validation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}