{"id":"69af345d4ea44d60","repo":"jackc/pgx","slug":"gss-encoding-request-too-short","errorCode":null,"errorMessage":"gss encoding request too short","messagePattern":"gss encoding request too short","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgproto3/gss_enc_request.go","lineNumber":20,"sourceCode":"\nimport (\n\t\"encoding/binary\"\n\t\"encoding/json\"\n\t\"errors\"\n\n\t\"github.com/jackc/pgx/v5/internal/pgio\"\n)\n\nconst gssEncReqNumber = 80877104\n\ntype GSSEncRequest struct{}\n\n// Frontend identifies this message as sendable by a PostgreSQL frontend.\nfunc (*GSSEncRequest) Frontend() {}\n\nfunc (dst *GSSEncRequest) Decode(src []byte) error {\n\tif len(src) < 4 {\n\t\treturn errors.New(\"gss encoding request too short\")\n\t}\n\n\trequestCode := binary.BigEndian.Uint32(src)\n\n\tif requestCode != gssEncReqNumber {\n\t\treturn errors.New(\"bad gss encoding request code\")\n\t}\n\n\treturn nil\n}\n\n// Encode encodes src into dst. dst will include the 4 byte message length.\nfunc (src *GSSEncRequest) Encode(dst []byte) ([]byte, error) {\n\tdst = pgio.AppendInt32(dst, 8)\n\tdst = pgio.AppendInt32(dst, gssEncReqNumber)\n\treturn dst, nil\n}\n","sourceCodeStart":2,"sourceCodeEnd":38,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgproto3/gss_enc_request.go#L2-L38","documentation":"Returned by GSSEncRequest.Decode when the supplied byte slice is shorter than 4 bytes. The first 4 bytes carry the GSS-encryption request magic number (80877104), so fewer than 4 bytes cannot be read. The library refuses to read past the buffer end rather than returning garbage.","triggerScenarios":"`(*GSSEncRequest).Decode(src)` is called with `len(src) < 4`. Occurs on the receiving side of a GSS request (a server, proxy, or test harness) when the framed body is truncated.","commonSituations":"A server or proxy receives a short first read and hands the partial buffer to Decode before the full 4 bytes arrive. Also seen in fuzzers or when a non-GSS packet is routed to the GSS decoder.","solutions":["Ensure the framing layer reads the complete 8-byte GSS request (4-byte length + 4-byte code) before invoking Decode; the body passed to Decode must be at least 4 bytes.","If reading manually, loop until at least 4 bytes are buffered before decoding.","Confirm the sender is actually emitting a GSS-encryption request (magic 80877104), not an SSL request or startup packet.","Log the actual length to distinguish a partial read from a misrouted message."],"exampleFix":"// before\nvar gss pgproto3.GSSEncRequest\nerr := gss.Decode(buf) // buf is a partial 2-byte read\n\n// after\nif len(buf) < 4 {\n    return fmt.Errorf(\"need >=4 bytes to decode GSS request, got %d\", len(buf))\n}\nvar gss pgproto3.GSSEncRequest\nerr := gss.Decode(buf)","handlingStrategy":"validation","validationCode":"func validateGSSEncRequestBody(src []byte) error {\n\tif len(src) < 4 {\n\t\treturn fmt.Errorf(\"gss request body too short: %d bytes (need >=4)\", len(src))\n\t}\n\treturn nil\n}","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Read the complete 8-byte GSS request (4-byte length + 4-byte code) before decoding.","Loop until at least 4 body bytes are buffered for manual readers.","Confirm the sender is actually emitting a GSS request before routing to the GSS decoder."],"tags":["pgproto3","protocol","decoding","gss","wire-protocol","validation"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}