{"record":{"id":"e933a00961e6503c","repo":"golang/go","slug":"input-overflows-the-modulus-size","errorCode":null,"errorMessage":"input overflows the modulus size","messagePattern":"input overflows the modulus size","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/bigmod/nat.go","lineNumber":207,"sourceCode":"\t}\n\treturn x, nil\n}\n\n// SetOverflowingBytes assigns x = b, where b is a slice of big-endian bytes.\n// SetOverflowingBytes returns an error if b has a longer bit length than m, but\n// reduces overflowing values up to 2^⌈log2(m)⌉ - 1.\n//\n// The output will be resized to the size of m and overwritten.\nfunc (x *Nat) SetOverflowingBytes(b []byte, m *Modulus) (*Nat, error) {\n\tx.resetFor(m)\n\tif err := x.setBytes(b); err != nil {\n\t\treturn nil, err\n\t}\n\t// setBytes would have returned an error if the input overflowed the limb\n\t// size of the modulus, so now we only need to check if the most significant\n\t// limb of x has more bits than the most significant limb of the modulus.\n\tif bitLen(x.limbs[len(x.limbs)-1]) > bitLen(m.nat.limbs[len(m.nat.limbs)-1]) {\n\t\treturn nil, errors.New(\"input overflows the modulus size\")\n\t}\n\tx.maybeSubtractModulus(no, m)\n\treturn x, nil\n}\n\n// bigEndianUint returns the contents of buf interpreted as a\n// big-endian encoded uint value.\nfunc bigEndianUint(buf []byte) uint {\n\tif _W == 64 {\n\t\treturn uint(byteorder.BEUint64(buf))\n\t}\n\treturn uint(byteorder.BEUint32(buf))\n}\n\nfunc (x *Nat) setBytes(b []byte) error {\n\ti, k := len(b), 0\n\tfor k < len(x.limbs) && i >= _S {\n\t\tx.limbs[k] = bigEndianUint(b[i-_S : i])","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/bigmod/nat.go#L189-L225","documentation":"Thrown by bigmod.(*Nat).SetOverflowingBytes when the most significant limb of the decoded x has more set bits than the most significant limb of m. Unlike SetBytes, SetOverflowingBytes tolerates values in [m, 2^ceil(log2(m)) - 1], but it still rejects inputs whose bit length exceeds the modulus's bit length.","triggerScenarios":"Calling SetOverflowingBytes(b, m) with b whose bit length is greater than that of m — i.e. the top limb carries a bit beyond the modulus's top limb.","commonSituations":"Passing a hash output or computed value that is wider than the curve order without prior truncation, or a byte slice longer than the modulus representation that survives setBytes.","solutions":["Truncate or reduce the input so its bit length does not exceed that of m before calling SetOverflowingBytes.","Check len(b) against m.Size(); a longer byte slice means the value's bit length definitely exceeds the modulus.","Confirm you are passing the correct modulus for the input's expected size."],"exampleFix":"// before\nv, err := bigmod.NewNat().SetOverflowingBytes(hashTooWide, c.N)\n\n// after: ensure the input is truncated to the order size first\nif len(hashTooWide) > c.N.Size() {\n    hashTooWide = hashTooWide[len(hashTooWide)-c.N.Size():]\n}\nv, err := bigmod.NewNat().SetOverflowingBytes(hashTooWide, c.N)","handlingStrategy":"validation","validationCode":"// Reject inputs whose byte length exceeds the modulus before SetOverflowingBytes.\nif len(b) > m.Size() {\n    return fmt.Errorf(\"bit length exceeds modulus size\")\n}\nreturn bigmod.NewNat().SetOverflowingBytes(b, m)","typeGuard":"func fitsModulusBitLen(b []byte, m *bigmod.Modulus) bool {\n    return len(b) <= m.Size()\n}","tryCatchPattern":"v, err := bigmod.NewNat().SetOverflowingBytes(b, m)\nif err != nil {\n    // truncate to the low order-sized bytes if the high bytes are zero-padding\n    if len(b) > m.Size() && allZero(b[:len(b)-m.Size()]) {\n        b = b[len(b)-m.Size():]\n        v, err = bigmod.NewNat().SetOverflowingBytes(b, m)\n    }\n    if err != nil { return err }\n}","preventionTips":["Truncate hashes to the order byte length before passing them in.","Strip non-significant leading zero bytes consistently.","Unit-test boundary inputs equal to 2^bitlen(m)."],"tags":["go","crypto","fips","bigmod","modular-arithmetic","input-validation"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}