sqlmapproject/sqlmap · error · NumericOutOfRange

not in [ , ]

Error message

%s not in [%d,%d]

What it means

Membership window scan in _readNum exhausted the whole [lo,hi] range without an IN-match, and the fallback '=' scan also found nothing. The value genuinely lies outside the probed bounds (or the oracle lied), so NumericOutOfRange is raised for the caller to classify as truncated length or integer overflow.

Solutions

1. Widen the [lo,hi] bounds and retry the read
2. Classify per call site: length -> truncated result, integer -> overflow
3. Verify oracle consistency if values should have been in range

When it happens

Trigger: Thrown at extra/esperanto/extraction.py:172 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/9d1ef1eead31b6ad. Report an issue: GitHub.

Appendix: source

Thrown at extra/esperanto/extraction.py:172

        saturates to `hi`, BETWEEN converges to a wrong SMALL value) - so an
        out-of-range value raises NumericOutOfRange for the caller to classify
        (length -> truncated, integer -> overflow) instead of returning wrong data."""
        if self._comparator == "membership":
            if self._inOk:
                window = 128
                base = lo
                while base <= hi:
                    win = list(range(base, min(base + window, hi + 1)))
                    if self._ask("%s IN (%s)" % (expr, ",".join(str(v) for v in win))):
                        while len(win) > 1:
                            half = win[:len(win) // 2]
                            if self._ask("%s IN (%s)" % (expr, ",".join(str(v) for v in half))):
                                win = half
                            else:
                                win = win[len(win) // 2:]
                        return win[0]
                    base += window
                raise NumericOutOfRange("%s not in [%d,%d]" % (expr, lo, hi))
            for v in range(lo, hi + 1):             # no ordered op and no IN: '=' scan
                if self._ask("%s=%d" % (expr, v)):
                    return v
            raise NumericOutOfRange("%s not in [%d,%d]" % (expr, lo, hi))
        # ordered comparators (gt / between / operator-free rung): prove range first
        if self._comparator == "between":
            if not self._ask("%s BETWEEN %d AND %d" % (expr, lo, hi)):
                raise NumericOutOfRange("%s not in [%d,%d]" % (expr, lo, hi))
        else:                                       # gt or operator-free rung ('>' semantics)
            if self._gtNum(expr, hi, hi):
                raise NumericOutOfRange("%s > %d" % (expr, hi))
            if not self._gtNum(expr, lo - 1, hi):   # expr <= lo-1 -> below range (any sign of lo)
                raise NumericOutOfRange("%s < %d" % (expr, lo))
        low, high = lo, min(max(lo, 8), hi)         # exponential climb keeps small values cheap
        while high < hi and self._gtNum(expr, high, hi):
            low, high = high + 1, min(high * 2, hi)
        while low < high:
            mid = (low + high) // 2

View on GitHub (pinned to 0a35b20e39)