FAILURE MAP
← Case archive

FA-226 / Protocols / Open access

A varint decoder accepts an ambiguous or overflowing frame · case 01

Trailing bytes, overlong encodings, and values larger than the specified integer width are accepted.

Verified by executionVariant 1 · 9 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The decoder accumulates seven-bit groups without enforcing termination, canonical length, and the numeric bound together.

THE FAILURE

The decoder accumulates seven-bit groups without enforcing termination, canonical length, and the numeric bound together.

Unsuccessful approach: Stopping at the first terminating byte ignores trailing data and does not reject overlong or overflowing representations.

Case contract

Decode exactly one minimally encoded unsigned 32-bit LEB128 integer from bytes. Return None for an empty, unterminated, overlong, overflowing, or multi-value input; otherwise return the integer.

Why this case matters

Binary framing needs a single accepted representation and an exact consumption contract. Decoding a numeric prefix alone cannot establish that the whole frame was valid.

1 / The failure

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(data):
    return sum((byte & 0x7f) << (7 * index) for index, byte in enumerate(data))
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('zero uses one byte', solve(b'\x00'), 0)
check('single-byte variant', solve(bytes([N])), N)
check('two-byte variant', solve(bytes([0x80 | N, N])), 129 * N)
check('maximum uint32', solve(b'\xff\xff\xff\xff\x0f'), 4294967295)
check('overflow fifth group rejected', solve(b'\xff\xff\xff\xff' + bytes([15 + N])), None)
check('overlong zero rejected', solve(b'\x80' * N + b'\x00'), None)
check('trailing value rejected', solve(bytes([N, N + 1])), None)
check('unterminated input rejected', solve(b'\x80' * N), None)
check('empty input rejected', solve(b''), None)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
zero uses one byte00Passed
single-byte variant11Passed
two-byte variant129129Passed
maximum uint3242949672954294967295Passed
overflow fifth group rejected4563402751NoneFailed
overlong zero rejected0NoneFailed
trailing value rejected257NoneFailed
unterminated input rejected0NoneFailed
empty input rejected0NoneFailed

SHA-256 / 06df464b3e516fc694675c6633871a964b90e19a05a24c27ede65ac3409cf6b9

2 / The unsuccessful fix

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(data):
    value = 0
    for index, byte in enumerate(data[:5]):
        value |= (byte & 0x7f) << (7 * index)
        if byte < 0x80:
            return value
    return None
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('zero uses one byte', solve(b'\x00'), 0)
check('single-byte variant', solve(bytes([N])), N)
check('two-byte variant', solve(bytes([0x80 | N, N])), 129 * N)
check('maximum uint32', solve(b'\xff\xff\xff\xff\x0f'), 4294967295)
check('overflow fifth group rejected', solve(b'\xff\xff\xff\xff' + bytes([15 + N])), None)
check('overlong zero rejected', solve(b'\x80' * N + b'\x00'), None)
check('trailing value rejected', solve(bytes([N, N + 1])), None)
check('unterminated input rejected', solve(b'\x80' * N), None)
check('empty input rejected', solve(b''), None)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
zero uses one byte00Passed
single-byte variant11Passed
two-byte variant129129Passed
maximum uint3242949672954294967295Passed
overflow fifth group rejected4563402751NoneFailed
overlong zero rejected0NoneFailed
trailing value rejected1NoneFailed
unterminated input rejectedNoneNonePassed
empty input rejectedNoneNonePassed

SHA-256 / 267d32f8602d9ad2dea37fb1d0a0fa4949d8ab1909c55e61dba19f5e08b6935b

HELD IN THE MEMBER ARCHIVE

The verified repair and its recorded checks are member-only.

This mechanism has 9 recorded checks per implementation. The open-access tier publishes the failure and the unsuccessful fix; the repaired source that passes every check, and the observations that prove it, are available to members.

Every case sharing this mechanism uses the same contract and the same repair, so this one record is held back for all of them.

Member access is invitation-based. Sign in with your invited account to inspect the repair.

Sign in to the archive ↗

Verification & scope

This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:36:51.525124+00:00.

Case digest / fca97da7da8742092a000b24e7d0d8cb05cff98caffc4864750f07cd314ec04b