crowdsecurity/crowdsec · error

out of bound gid

Error message

out of bound gid

What it means

getGID parses the group ID string from a syscall.Stat_t / user lookup into an int32 and validates it fits in a uint32-compatible range before returning it. It throws 'out of bound gid' when the parsed gid is negative or exceeds math.MaxInt32, guarding against invalid or corrupted group identifiers.

Source

Thrown at pkg/csplugin/utils.go:63

		return 0, err
	}
	if uid < 0 || uid > math.MaxInt32 {
		return 0, errors.New("out of bound uid")
	}
	return uint32(uid), nil
}

func getGID(groupname string) (uint32, error) {
	g, err := user.LookupGroup(groupname)
	if err != nil {
		return 0, err
	}
	gid, err := strconv.ParseInt(g.Gid, 10, 32)
	if err != nil {
		return 0, err
	}
	if gid < 0 || gid > math.MaxInt32 {
		return 0, errors.New("out of bound gid")
	}
	return uint32(gid), nil
}

func getPluginTypeAndSubtypeFromPath(path string) (string, string, error) {
	pluginFileName := filepath.Base(path)
	parts := strings.Split(pluginFileName, "-")
	if len(parts) < 2 {
		return "", "", fmt.Errorf("plugin name %s is invalid. Name should be like {type-name}", path)
	}
	return strings.Join(parts[:len(parts)-1], "-"), parts[len(parts)-1], nil
}

func getProcessAttr(username string, groupname string) (*unix.SysProcAttr, error) {
	uid, err := getUID(username)
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to 909b515798)

Solutions

  1. Check the gid configured for the crowdsec user/group in the config (api.server or plugin section) and set a valid numeric group ID between 0 and 2147483647
  2. Verify with 'id <user>' that the group's gid is a sane positive value
  3. Fix the /etc/group entry if the gid is corrupt or negative

Example fix

// before
gid, err := strconv.ParseInt(g.Gid, 10, 32)
// after
if gid, err := strconv.ParseInt(g.Gid, 10, 32); err == nil && gid >= 0 && gid <= math.MaxInt32 {
    // proceed
}
Defensive patterns

Strategy: validation

Validate before calling

if v, err := strconv.ParseInt(gidStr, 10, 32); err != nil || v < 0 || v > math.MaxInt32 { return fmt.Errorf("invalid gid %q", gidStr) }

Type guard

func gidInRange(v int64) bool { return v >= 0 && v <= math.MaxInt32 }

Try / catch

gid, err := getGID(g)
if err != nil { return fmt.Errorf("while getting gid for plugin user: %w", err) }

Prevention

When it happens

Trigger: Called from getProcessAttr when starting a plugin subprocess: the configured group (via config user/group or the process's own gid from os.Getgroups/stat) parses to a value < 0 or > 2147483647.

Common situations: A corrupted or hand-edited config specifying a gid string like '-1' or a huge number; unusual numeric gids from exotic user databases; a stat reporting an overflowed gid on a weird filesystem.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors


AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ec1d2d5a4857e96d. Report an issue: GitHub.