{"record":{"id":"dd55a43f7f30f133","repo":"basecamp/fizzy","slug":"reserved-additional-info-info","errorCode":null,"errorMessage":"Reserved additional info: #{info}","messagePattern":"Reserved additional info: #(.+?)","errorType":"exception","errorClass":"ActionPack::WebAuthn::InvalidCborError","httpStatus":null,"severity":"error","filePath":"lib/action_pack/web_authn/cbor_decoder.rb","lineNumber":235,"sourceCode":"        Math.ldexp(mantissa, -24)\n      elsif exponent == 31\n        mantissa == 0 ? Float::INFINITY : Float::NAN\n      else\n        Math.ldexp(mantissa + 1024, exponent - 25)\n      end\n\n      sign == 1 ? -value : value\n    end\n\n    def read_argument\n      case info = additional_info\n      when SIMPLE_VALUE_RANGE then info\n      when SINGLE_BYTE_VALUE_FOLLOWS then read_byte\n      when TWO_BYTE_VALUE_FOLLOWS then read_bytes(2).pack(\"C*\").unpack1(\"n\")\n      when FOUR_BYTE_VALUE_FOLLOWS then read_bytes(4).pack(\"C*\").unpack1(\"N\")\n      when EIGHT_BYTE_VALUE_FOLLOWS then read_bytes(8).pack(\"C*\").unpack1(\"Q>\")\n      when RESERVED_VALUE_RANGE\n        raise ActionPack::WebAuthn::InvalidCborError, \"Reserved additional info: #{info}\"\n      else\n        raise ActionPack::WebAuthn::InvalidCborError, \"Invalid additional info: #{info}\"\n      end\n    end\n\n    def additional_info(consume: true)\n      byte = consume ? read_byte : peek\n      byte & 0b00011111\n    end\n\n    def indefinite_length?\n      read_byte if additional_info(consume: false) == INDEFINITE_LENGTH_MAJOR_TYPE\n    end\n\n    def break_code?\n      read_byte if peek == BREAK_CODE\n    end\n","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/basecamp/fizzy/blob/7aabe7458060d8a1759a53b7ede39e74e6c0b20d/lib/action_pack/web_authn/cbor_decoder.rb#L217-L253","documentation":"read_argument decodes the length/argument that follows a CBOR header byte. Additional-info values 28–30 are reserved by RFC 8949 for future standardization and no conformant encoder emits them; encountering one means the header byte is corrupt, so the decoder raises InvalidCborError with the reserved value.","triggerScenarios":"A header byte whose low 5 bits are 28/29/30 (e.g. 0x9C, 0x9D, 0x9E for text strings) anywhere a length argument is read — result of random corruption, fuzzing, or mis-copied byte strings.","commonSituations":"Bit-rot or transmission errors in binary payloads; hand-assembled CBOR where a length was written as the raw value instead of an encoded argument; concatenating CBOR fragments mid-item.","solutions":["Hex-dump the input and check the failing offset's header byte — low 5 bits in 28..30 confirm corruption.","Re-encode the payload with a standard CBOR library rather than patching bytes.","Rescue ActionPack::WebAuthn::InvalidCborError once at the call site and reject the payload with 400.","Add an integrity check (HMAC or signature verification happens anyway in WebAuthn) before parsing to discard tampered input early."],"exampleFix":"# before\nvalue = ActionPack::WebAuthn::CborDecoder.decode(bytes)\n\n# after — single choke point for every CBOR syntax error (reserved info, bad lengths, truncation)\ndef decode_cbor(bytes)\n  ActionPack::WebAuthn::CborDecoder.decode(bytes)\nrescue ActionPack::WebAuthn::InvalidCborError\n  raise ApplicationController::BadRequest, 'malformed CBOR payload'\nend","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"begin\n  value = ActionPack::WebAuthn::CborDecoder.decode(bytes)\nrescue ActionPack::WebAuthn::InvalidCborError => e\n  render json: { error: 'malformed CBOR payload' }, status: :bad_request\nend","preventionTips":["Verify payload integrity (signature/HMAC) before parsing; tampered bytes surface as reserved-info errors.","Transport CBOR as binary; avoid text pipelines that can flip bytes.","Use one central rescue for all InvalidCborError variants and map to 400."],"tags":["cbor","malformed-data","rfc8949","binary-parsing"],"backgroundTag":"cbor-malformed-data","analyzedSha":"7aabe7458060d8a1759a53b7ede39e74e6c0b20d","analyzedAt":"2026-08-21T18:33:25.349Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}