valyala/fasthttp · error

too long int

Error message

too long int

What it means

errTooLongInt is returned by parseUintBuf when the numeric value overflows the platform int (checked via maxIntDiv10 = math.MaxInt/10 during accumulation). The library parses into machine ints, so values beyond math.MaxInt (or the 64-bit limit) cannot be represented. This protects against integer overflow from hostile input.

Source

Thrown at bytesconv.go:279

// ParseUint parses uint from buf.
//
// A value too large for an int is an error rather than a wrapped result, so
// ParseUint accepts exactly the unsigned decimal strings whose value fits in an
// int on the current platform.
func ParseUint(buf []byte) (int, error) {
	v, n, err := parseUintBuf(buf)
	if n != len(buf) {
		return -1, errUnexpectedTrailingChar
	}
	return v, err
}

var (
	errEmptyInt               = errors.New("empty integer")
	errIPv4PartTooLarge       = errors.New("ip part cannot exceed 255")
	errUnexpectedFirstChar    = errors.New("unexpected first char found: expecting 0-9")
	errUnexpectedTrailingChar = errors.New("unexpected trailing char found: expecting 0-9")
	errTooLongInt             = errors.New("too long int")
)

const (
	// maxIntDiv10 is the largest accumulator that can still take another digit.
	// Anything above it overflows an int when multiplied by 10.
	maxIntDiv10 = math.MaxInt / 10

	// maxSafeIntDigits is how many leading decimal digits can never overflow an
	// int, whatever the word size: 10**18-1 fits a 64-bit int and 10**9-1 fits a
	// 32-bit one. Go defines strconv.IntSize as 32 or 64 and nothing else.
	// TestMaxSafeIntDigits checks both halves of that claim on the build's own
	// int size.
	maxSafeIntDigits = 9 * (strconv.IntSize / 32)
)

func parseUintBuf(b []byte) (int, int, error) {
	if len(b) == 0 {
		return -1, 0, errEmptyInt

View on GitHub (pinned to c96f600972)

Solutions

1. Cap the input length (e.g. reject len(buf) > 18) before parsing when the semantic range is known.
2. After a successful parse, range-check the result against your domain limit (max body size, max timeout) and reject out-of-range values.
3. Treat this error from untrusted input as a 400 response and log the client for probing.
4. If you legitimately need big numbers, parse with math/big or uint64 via strconv.ParseUint instead of fasthttp's int-based parser.

Example fix

// before
n, err := fasthttp.ParseUint(userLen)
// after
n, err := fasthttp.ParseUint(userLen)
if err != nil || n < 0 || n > maxAllowedSize {
    return http.StatusBadRequest
}

const maxReasonable = 1 << 30
func parseUintBounded(b []byte, max int) (int, error) {
    if len(b) > 18 { // int64 max has 19 digits; reject early
        return 0, errors.New("number too large")
    }
    n, err := fasthttp.ParseUint(b)
    if err != nil {
        return 0, err
    }
    if n > max {
        return 0, fmt.Errorf("value %d exceeds limit %d", n, max)
    }
    return n, nil
}

func safeUintLen(b []byte) bool { return len(b) <= 18 }

n, err := fasthttp.ParseUint(b)
if err != nil && err.Error() == "too long int" {
    return 0, errors.New("numeric value out of range")
}

When it happens

Trigger: ParseUint with 20+ digit numbers like "99999999999999999999"; Content-Length or Args.GetUint values crafted to overflow; parseIPv4Octet with extremely long octet strings.

Common situations: Malicious requests with absurdly long numeric fields (DoS/overflow probes); copy-paste errors in config; accepting unbounded user input as sizes or timeouts.

Related errors

• empty integer
• unexpected first char found: expecting 0-9
• unexpected trailing char found: expecting 0-9
• fasthttp: no args value for the given key
• empty ip address string

AI-assisted analysis of valyala/fasthttp@c96f600972 (2026-08-31). Data as JSON: /api/errors/7f84a6d7272c8fba. Report an issue: GitHub.