{"id":"b5e23884d75d9b98","repo":"jackc/pgx","slug":"bad-auth-type-b5e238","errorCode":null,"errorMessage":"bad auth type","messagePattern":"bad auth type","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgproto3/authentication_md5_password.go","lineNumber":32,"sourceCode":"}\n\n// Backend identifies this message as sendable by the PostgreSQL backend.\nfunc (*AuthenticationMD5Password) Backend() {}\n\n// Backend identifies this message as an authentication response.\nfunc (*AuthenticationMD5Password) AuthenticationResponse() {}\n\n// Decode decodes src into dst. src must contain the complete message with the exception of the initial 1 byte message\n// type identifier and 4 byte message length.\nfunc (dst *AuthenticationMD5Password) Decode(src []byte) error {\n\tif len(src) != 8 {\n\t\treturn errors.New(\"bad authentication message size\")\n\t}\n\n\tauthType := binary.BigEndian.Uint32(src)\n\n\tif authType != AuthTypeMD5Password {\n\t\treturn errors.New(\"bad auth type\")\n\t}\n\n\tcopy(dst.Salt[:], src[4:8])\n\n\treturn nil\n}\n\n// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.\nfunc (src *AuthenticationMD5Password) Encode(dst []byte) ([]byte, error) {\n\tdst, sp := beginMessage(dst, 'R')\n\tdst = pgio.AppendUint32(dst, AuthTypeMD5Password)\n\tdst = append(dst, src.Salt[:]...)\n\treturn finishMessage(dst, sp)\n}\n\n// MarshalJSON implements encoding/json.Marshaler.\nfunc (src AuthenticationMD5Password) MarshalJSON() ([]byte, error) {\n\treturn json.Marshal(struct {","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgproto3/authentication_md5_password.go#L14-L50","documentation":"Returned by AuthenticationMD5Password.Decode in pgproto3/authentication_md5_password.go:32 when the leading 4 bytes are not AuthTypeMD5Password (5). Redundant with frontend dispatch; firing means corruption after dispatch or Decode called on bytes whose code is not 5.","triggerScenarios":"Manual/proxy code decoding a non-MD5 frame with the MD5 struct; buffer mutation; fuzz input.","commonSituations":"Test/proxy hard-coding the wrong struct; corrupted reused buffer.","solutions":["Dispatch through findAuthenticationMessageType instead of a fixed struct.","Switch on the auth code (5 => MD5) when decoding manually.","Avoid reusing the byte buffer across messages."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeMD5Password {\n    var m pgproto3.AuthenticationMD5Password\n    return m.Decode(body)\n}","typeGuard":"func isMD5AuthFrame(body []byte) bool {\n    return len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeMD5Password\n}","tryCatchPattern":null,"preventionTips":["Dispatch through findAuthenticationMessageType instead of a fixed struct.","Switch on the auth code (5 => MD5) before Decode.","Avoid reusing the byte buffer across messages."],"tags":["authentication","protocol","md5","pgproto3","validation"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}