{"record":{"id":"dcec7808241ac23b","repo":"hyperledger/fabric","slug":"getsignatureheaderfrombytes-failed-err-s","errorCode":null,"errorMessage":"GetSignatureHeaderFromBytes failed, err %s","messagePattern":"GetSignatureHeaderFromBytes failed, err (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"protoutil/signeddata.go","lineNumber":79,"sourceCode":"func EnvelopeAsSignedData(env *common.Envelope) ([]*SignedData, error) {\n\tif env == nil {\n\t\treturn nil, errors.New(\"No signatures for nil Envelope\")\n\t}\n\n\tpayload := &common.Payload{}\n\terr := proto.Unmarshal(env.Payload, payload)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif payload.Header == nil /* || payload.Header.SignatureHeader == nil */ {\n\t\treturn nil, errors.New(\"Missing Header\")\n\t}\n\n\tshdr := &common.SignatureHeader{}\n\terr = proto.Unmarshal(payload.Header.SignatureHeader, shdr)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"GetSignatureHeaderFromBytes failed, err %s\", err)\n\t}\n\n\treturn []*SignedData{{\n\t\tData:      env.Payload,\n\t\tIdentity:  shdr.Creator,\n\t\tSignature: env.Signature,\n\t}}, nil\n}\n\n// LogMessageForSerializedIdentity returns a string with serialized identity information,\n// or a string indicating why the serialized identity information cannot be returned.\n// Any errors are intentionally returned in the return strings so that the function can be used in single-line log messages with minimal clutter.\nfunc LogMessageForSerializedIdentity(serializedIdentity []byte) string {\n\tid := &msp.SerializedIdentity{}\n\terr := proto.Unmarshal(serializedIdentity, id)\n\tif err != nil {\n\t\treturn fmt.Sprintf(\"Could not unmarshal serialized identity: %s\", err)\n\t}","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/protoutil/signeddata.go#L61-L97","documentation":"EnvelopeAsSignedData unmarshals Payload.Header.SignatureHeader into a common.SignatureHeader to obtain the creator identity. If those bytes fail proto unmarshaling, the envelope is structurally corrupt and this wrapped error reports the underlying unmarshal failure.","triggerScenarios":"An envelope whose Payload.Header.SignatureHeader bytes are not a valid protobuf SignatureHeader — random bytes placed in the field, bytes from a different message type, or truncation/corruption in transit or storage.","commonSituations":"Hand-crafted envelopes in tests with ad-hoc header bytes; blockstore corruption; version-mismatched clients writing incompatible header encodings; proxy/middleware mutating payload bytes.","solutions":["Regenerate the envelope with a properly marshaled SignatureHeader (protoutil.MakeSignatureHeader + MakePayloadHeader).","Verify the bytes assigned to SignatureHeader are the canonical serialization of a common.SignatureHeader (creator + nonce).","Check for corruption in transit/storage — re-fetch the block or envelope from the source.","If a custom client constructs headers, round-trip test: unmarshal what you marshal before signing."],"exampleFix":"// before\npayload.Header = &common.Header{SignatureHeader: rawRandomBytes}\n\n// after\nshdr := &common.SignatureHeader{Creator: creator, Nonce: nonce}\nif payload.Header == nil {\n    payload.Header = &common.Header{}\n}\npayload.Header.SignatureHeader = protoutil.MarshalOrPanic(shdr)","handlingStrategy":"validation","validationCode":"shdr := &common.SignatureHeader{}\nif err := proto.Unmarshal(payload.Header.SignatureHeader, shdr); err != nil {\n    return fmt.Errorf(\"invalid signature header bytes: %w\", err)\n}\nif len(shdr.Creator) == 0 || len(shdr.Nonce) == 0 {\n    return errors.New(\"signature header needs creator and nonce\")\n}","typeGuard":"func parseSignatureHeader(b []byte) (*common.SignatureHeader, bool) {\n    sh := &common.SignatureHeader{}\n    if proto.Unmarshal(b, sh) != nil || sh == nil {\n        return nil, false\n    }\n    return sh, true\n}","tryCatchPattern":"sd, err := protoutil.EnvelopeAsSignedData(env)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"GetSignatureHeaderFromBytes failed\") {\n        return fmt.Errorf(\"corrupt envelope rejected: %w\", err)\n    }\n    return err\n}","preventionTips":["Assign SignatureHeader bytes only from protoutil.MarshalOrPanic(&common.SignatureHeader{...}).","Round-trip test marshaled headers in any custom client.","Protect block storage from corruption; verify hashes when reading stored blocks.","Never mutate envelope bytes in middleware/proxies."],"tags":["fabric","signature-header","protobuf","malformed-payload"],"backgroundTag":"protobuf-unmarshal-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}