{"id":"60cabfcae71c2584","repo":"hyperium/hyper","slug":"invalid-chunk-size-overflow","errorCode":null,"errorMessage":"invalid chunk size: overflow","messagePattern":"invalid chunk size: overflow","errorType":"exception","errorClass":"std::io::Error","httpStatus":null,"severity":"error","filePath":"src/proto/h1/decode.rs","lineNumber":268,"sourceCode":"}\n\nmacro_rules! byte (\n    ($rdr:ident, $cx:expr) => ({\n        let buf = ready!($rdr.read_mem($cx, 1))?;\n        if !buf.is_empty() {\n            buf[0]\n        } else {\n            return Poll::Ready(Err(io::Error::new(io::ErrorKind::UnexpectedEof,\n                                      \"unexpected EOF during chunk size line\")));\n        }\n    })\n);\n\nmacro_rules! or_overflow {\n    ($e:expr) => (\n        match $e {\n            Some(val) => val,\n            None => return Poll::Ready(Err(io::Error::new(\n                io::ErrorKind::InvalidData,\n                \"invalid chunk size: overflow\",\n            ))),\n        }\n    )\n}\n\nmacro_rules! put_u8 {\n    ($trailers_buf:expr, $byte:expr, $limit:expr) => {\n        $trailers_buf.put_u8($byte);\n\n        if $trailers_buf.len() >= $limit {\n            return Poll::Ready(Err(io::Error::new(\n                io::ErrorKind::InvalidData,\n                \"chunk trailers bytes over limit\",\n            )));\n        }\n    };","sourceCodeStart":250,"sourceCodeEnd":286,"githubUrl":"https://github.com/hyperium/hyper/blob/084473f728f9d07b3be5845475aa2f62ed9ff579/src/proto/h1/decode.rs#L250-L286","documentation":"Thrown in the HTTP/1 chunked decoder via the or_overflow! macro (src/proto/h1/decode.rs:268) as io::Error::new(InvalidData, \"invalid chunk size: overflow\"). It fires when the hex chunk-size being parsed would exceed u64 — i.e. the chunk-size field has so many hex digits it overflows. It is raised inside read_start/read_size (decode.rs:352-393) every time a digit shifts the accumulator with checked_mul/checked_add that returns None.","triggerScenarios":"The chunk-size line contains an absurdly long run of hex digits (>16) such that size.checked_mul(16)/checked_add overflows u64 (decode.rs:264-273 guarding every accumulation in read_start/read_size). Triggered by a malformed or malicious chunked body advertising a near-u64-max chunk size.","commonSituations":"A buggy producer emits a garbage chunk-size line; a fuzzing/attack payload with a huge hex size; a misbehaving proxy that mangles chunk framing. Benign clients never send chunk sizes anywhere near the limit, so this almost always indicates corruption or abuse.","solutions":["Treat it as a corrupt/malicious request — close the connection and do not process the body.","If you control the producer, ensure chunk sizes are correct hex and far below u64::MAX (realistically bounded by your buffer/body limits).","Add a request body-size limit (and a WAF/rate-limiter) so oversized/abusive chunked uploads are rejected earlier."],"exampleFix":"// (consumer side) before: assume any body is well-formed\nlet bytes = hyper::body::to_bytes(req.into_body()).await?;\n\n// after: bound the body and reject framing errors as 400\nuse hyper::body::Body;\nmatch hyper::body::to_bytes(req.into_body()).await {\n    Ok(bytes) if bytes.len() <= MAX_BODY => Ok(bytes),\n    Ok(_) => Ok(response_413()),\n    Err(_) => Ok(response_400()), // includes 'invalid chunk size: overflow'\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":"fn is_invalid_chunk_size(err: &hyper::Error) -> bool {\n    matches!(\n        err.source().and_then(|s| s.downcast_ref::<std::io::Error>()).map(|io| io.kind()),\n        Some(std::io::ErrorKind::InvalidData)\n    )\n}","tryCatchPattern":"match hyper::body::to_bytes(req.into_body()).await {\n    Ok(b) if b.len() <= MAX_BODY => Ok(b),\n    Ok(_) => Ok(resp_413()),\n    Err(e) if is_invalid_chunk_size(&e) => Ok(resp_400()), // corrupt/abusive framing\n    Err(e) => Err(e),\n}","preventionTips":["Treat an invalid/overflow chunk size as a corrupt or malicious request — close the connection.","Enforce a request body-size limit and rate-limit abusive clients upstream.","If you generate chunked bodies, keep chunk sizes correct hex and realistically bounded."],"tags":["http1","chunked","overflow","validation","rust"],"analyzedSha":"084473f728f9d07b3be5845475aa2f62ed9ff579","analyzedAt":"2026-08-06T01:20:18.522Z","schemaVersion":2}