28845133019
77%

Ran 07 Jul 2026 07:06AM UTC

Jobs 1

Files 67

Run time 1min

Badge

Embed ▾

Committed 06 Jul 2026 11:44AM UTC coverage: 76.557% (-5.9%) from 82.503%

Build # 28845133019

Build Type

push

github

Committed by

web-flow

Commit Message

reject oversized message length in decodeStreamMsg (#8357)

    panic: runtime error: slice bounds out of range [:-1]
        decodeStreamMsg  server/jetstream_cluster.go  (buf[:ml])

`ml` is `int(le.Uint32(buf))`. On the 386/arm targets `int` is 32 bits,
so a length with the high bit set reads back negative and `len(buf) <
ml` compares a positive against a negative, which is false. Decode falls
through to `buf[:ml]` and panics. The decoder sits behind
`applyStreamMsgOp` and `processCatchupMsg`, so one malformed
`streamMsgOp` entry from a peer crashes a 32-bit follower's
apply/catchup goroutine.

Before: a negative `ml` slips past the guard on 32-bit; a large positive
`ml` was already rejected.
After: `ml < 0` is rejected next to the existing `len(buf) < ml`, so the
bound holds on every arch.

64-bit builds see no behavior change, since `int(uint32)` is never
negative there. The cost is one comparison on the decode path.

Coverage Stats

72204 of 94314 relevant lines covered (76.56%)

508978.32 hits per line

Coverage Regressions

Lines	Coverage	∆	File
2654	25.85	-64.35%	src/github.com/nats-io/nats-server/server/mqtt.go
535	86.26	-0.58%	src/github.com/nats-io/nats-server/server/stream.go
501	70.36	-17.29%	src/github.com/nats-io/nats-server/server/monitor.go
397	76.41	-14.12%	src/github.com/nats-io/nats-server/server/leafnode.go
362	23.76	-66.67%	src/github.com/nats-io/nats-server/server/msgtrace.go
285	51.67	-14.65%	src/github.com/nats-io/nats-server/server/reload.go
262	44.9	-22.07%	src/github.com/nats-io/nats-server/server/websocket.go
216	72.36	-10.22%	src/github.com/nats-io/nats-server/server/memstore.go
208	88.83	-4.29%	src/github.com/nats-io/nats-server/server/client.go
124	62.82	-2.53%	src/github.com/nats-io/nats-server/server/opts.go
124	0.0	-53.22%	src/github.com/nats-io/nats-server/server/proto.go
119	83.24	0.38%	src/github.com/nats-io/nats-server/server/jetstream_cluster.go
104	86.04	-3.09%	src/github.com/nats-io/nats-server/server/server.go
82	78.43	-0.73%	src/github.com/nats-io/nats-server/server/filestore.go
80	82.55	-3.07%	src/github.com/nats-io/nats-server/server/route.go
64	83.1	-5.01%	src/github.com/nats-io/nats-server/server/auth.go
51	79.44	0.24%	src/github.com/nats-io/nats-server/server/raft.go
42	6.67	-93.33%	src/github.com/nats-io/nats-server/server/monitor_sort_opts.go
41	84.99	-1.77%	src/github.com/nats-io/nats-server/server/events.go
30	55.49	-16.48%	src/github.com/nats-io/nats-server/server/log.go
27	74.48	-0.45%	src/github.com/nats-io/nats-server/server/jetstream_api.go
24	81.21	8.3%	src/github.com/nats-io/nats-server/server/avl/seqset.go
22	86.71	-0.64%	src/github.com/nats-io/nats-server/server/accounts.go
22	81.04	-2.08%	src/github.com/nats-io/nats-server/server/parser.go
20	89.49	-1.67%	src/github.com/nats-io/nats-server/server/sublist.go
14	93.43	-0.57%	src/github.com/nats-io/nats-server/server/gateway.go
9	72.31	-13.85%	src/github.com/nats-io/nats-server/server/feature_flags.go
5	87.82	0.29%	src/github.com/nats-io/nats-server/server/consumer.go
5	91.4	-0.63%	src/github.com/nats-io/nats-server/server/jetstream_batching.go
4	57.35	0.0%	src/github.com/nats-io/nats-server/server/jetstream_errors_generated.go
2	87.7	-0.82%	src/github.com/nats-io/nats-server/server/util.go
1	85.16	0.28%	src/github.com/nats-io/nats-server/server/jetstream.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	28845133019.1	07 Jul 2026 07:06AM UTC	67	76.56	GitHub Action Run

nats-io / nats-server / 28845133019
77%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 28845133019

nats-io / nats-server / 28845133019 77%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 28845133019

nats-io / nats-server / 28845133019
77%

README BADGES
x