fix(protobuf): reject malformed varints across values and framing

[samchon]

Closes #2256.

A malformed Protocol Buffer varint could become success-shaped decoded output. All value and framing consumers share the tenth wire byte, so the fix enforces its single legal payload bit in one reader boundary in _ProtobufReader.ts, and corrects the #2139 reader regression that had frozen ten-continuation acceptance.

Verification

Independently verified by an agent that did not write the implementation and built its own oracle rather than reusing the batch's test material.

Measure	Result
Differential vs official protowire v1.34.2 — 885 byte strings x 8 reader entry points	7080/7080 cells agree, 0 disagreements
Same differential on the base commit	3971 disagreeing cells over 530 inputs, every one accepts-illegal
Regressions / loosened cells introduced	0 / 0
Oracle-accepted inputs decoding to the exact value at the exact consumed length	208 / 208
Exhaustive tenth-byte partition, both prefix families	accepts exactly {0x00, 0x01}, bit-identical to the oracle; base accepted all 256
Cross-reader consistency among the 8 consumers	0 disagreements, against 269 on base
Public wrapper matrix (direct/factory x raw/assert/is/validate)	152/152 threw a prefixed Error — never null, never success: false

Mutation proof: reverting only _ProtobufReader.ts fails exactly the three coupled regressions while all fifteen adjacent protobuf controls pass. Gates at the head: pnpm build, 18 protobuf cases, 178-case test-typia-schema, feature identity, go vet in both trees, and tagged native ../native/... (28 packages, 0 failures).

The changed #2139 expectation is a correction, not a laundered regression

A previously merged test asserted that typia must accept 0x80 x10, 0x01 as 0. protowire rejects that input with n = -3. The old expectation was wrong; the new one matches both the wire specification and the oracle. Adjudicated independently against the specification rather than against this pull request's narrative.

Second commit: the oracle test could not fail

Independent verification found the first commit's permanent TestProtobufVarintBoundsOracle passed with the product fix fully reverted — it exercised protowire alone, never called typia, and its agreement with the TypeScript regressions was hand transcription. A permanent test that cannot fail when the work regresses is a false green, so the batch was returned for a test-asset remediation.

Every byte string and verdict now lives in one packages/typia/test/protobuf_varint_corpus.json that the Go test and both TypeScript regressions read. The Go test is renamed to state that it pins the official parser's verdicts only. Verified by mutating the corpus seven ways — value, consumed length, fault relabelling, emptied entries, unknown class, a fabricated contradictory row, and an accepted/rejected flip — with both halves reacting to every mutation.

The same commit splits one error message that had described two different faults: a continuing tenth byte keeps varint exceeds 10 bytes., while a terminating tenth byte carrying payload above bit 0 now reports varint exceeds 64 bits. Acceptance is byte-identical — proven by re-running the full 7080-cell differential across both heads: 0 acceptance differences, 0 value differences, 2088 message-only differences. No website page, documentation, example, or tracked test outside this batch pinned the old string.

Out of scope, recorded for the next discovery round

Two verified, user-visible defects present identically on the base commit and on this fix, outside this issue's published invariant: length prefixes and field tags are silently truncated to 32 bits, so a field declaring 4,294,967,301 bytes reads five, and field 536870913 aliases onto field 1. A third consumer of the same truncation, bool(), decodes from the low 32 bits only. None is locked in by the new tests, so the next round can decide the contract rather than inherit a snapshot.

Campaign constraints

No package version, tag, release, publication, or packages/interface/src change. pnpm format was not run.

[samchon]

Self-Review — round 1

Solo Self-Review under .agents/skills/review/SKILL.md. Snapshot 2d3b4181c28038a4b8429c86a6818c182d8dfbba, complete surface 3f59f641a9..2d3b4181c2 (eight files). Findings and remediation plan recorded here before any of them is applied.

Verified, no change needed

• The product fix matches its oracle byte for byte. Read the pinned google.golang.org/protobuf@v1.34.2 encoding/protowire/wire.go source directly: ConsumeVarint requires the tenth byte to be < 2 and returns errCodeTruncated = -1 / errCodeOverflow = -3. lastVarintByte accepts exactly 0x00 and 0x01 and rejects everything else, splitting the verdict into a length fault and a domain fault. Same accept/reject partition, finer error naming.
• Both fault classes reach every consumer. varint32 reads five bytes, then four, then lastVarintByte; varint64 reads nine, then lastVarintByte; skipVarint loops bytes one through nine, then lastVarintByte. Ten bytes maximum on all three paths, and the skip path now rejects the tenth-byte-payload class it previously accepted.
• The corpus is genuinely consumed, and a corrupted row fails a real assertion. Recomputed every accepted row's value independently from its own bytes (seven-bit little-endian groups, asUintN(64)); all 15 match the recorded value, every accepted row carries continuation bits on all but its last byte, and no accepted row exceeds ten bytes or carries more than bit 63 in its tenth. The Go side re-derives the same verdicts from protowire plus an internal-consistency gate; the TypeScript side reads the same rows through typia.assert<IDocument> and fails loudly on a lost field or an unknown fault class. Neither side transcribes a byte string.
• Repository format pipeline. scripts/format-go.cjs runs gofmt -w and then converts leading tabs to two spaces; the new Go test is byte-identical to that pipeline's output (the only diff is CRLF vs LF from the Windows checkout), so it matches every other Go file in the repository. Prettier reports the same style drift on untouched neighbours as on the changed files, so it is a repository-wide state that Post-Campaign Cleanup owns, not a defect of this branch.
• packages/typia/test is not in the published files list, so the corpus does not ship to npm consumers.
• Correcting test_protobuf_reader_unknown_field_faults. The #2139 assertion that uint32 may consume ten continuation bytes and return zero froze the defect; fix(protobuf): reject malformed varints across values and framing #2256 explicitly requires correcting it. It is replaced by a rejection plus a positive control that a legal ten-byte 0xff×9 0x01 still reads as 0xffffffff at index 10. Flagged as a deliberate specification change under the development skill's Change Integrity rule.

Findings to act on

1. An inaccurate claim I introduced one commit ago. test_protobuf_reader_varint_bounds now says the corpus carries "the canonical maximum that terminates at each width from one byte through ten". That is false for width two: the only two-byte rows are ac02 (300) and 8000 (non-canonical zero), neither of which is the two-byte maximum. Plan: add the ff7f / 16383 row rather than soften the sentence, so the family is uniform and the claim is exactly true.
2. skipVarint's doc comment no longer describes what skipVarint does. It still explains only the ten-byte length limit, but the method now also rejects a tenth byte carrying payload above bit 63. Plan: extend the comment to name both faults, matching lastVarintByte.

Deliberately not changed

• website/src/content/docs/protobuf/decode.mdx. Its "Wire errors" section already states that a malformed payload raises an Error before validation and propagates out of isDecode and validateDecode. This change makes the runtime match that documented contract rather than altering it, and fix(protobuf): reject malformed varints across values and framing #2256 names the page as the contract to preserve. Adding a varint sentence would be an enhancement that also drags in the website skill's full fresh-build validation lane, which is outside this unit's gate set.
• Renaming the local OVERFLOW constant in the protobuf tests, even though the corpus now uses "overflow" for the 64-bit-domain fault while that constant means buffer overflow.. Seven files across the suite already use that name for the reader's own message text; a one-file rename would break an established convention rather than fix an inconsistency.
• Recording the runtime divergence in _ProtobufReader.ts itself. The evidence belongs where a test pins it; a claim about another implementation's behaviour rots in shipped source.

Evidence run so far

Independent pre-flight against the real reader source (byte-identical copy with the enum and Singleton stubbed, run under node --experimental-strip-types), crossing all 32 corpus rows with uint32, int32, sint32, uint64, int64, sint64, bool, and skipVarint:

tree	assertions passed	assertions failed
head 2d3b4181c2	256	0
_ProtobufReader.ts reverted to 3f59f641a9	211	45

The 45 base failures are exactly the three over-long rows through the seven value readers (21) and the three overflow rows through the seven value readers plus the skip path (24); every accepted row still passes on the base, so the controls are not what moves. The base returned 9223372036854775807 from uint64 for ff×9 02 — the issue's own witness, reproduced from scratch on current master. This is a prediction that de-risks the long suite run, not a substitute for it; pnpm --filter ./tests/test-typia-schema start, pnpm test:go:public, pnpm test:go:native, pnpm --filter ./packages/typia build, and the disposable-worktree mutation proof are still required and are running or queued.

[samchon]

Superseded by #2266.

The maintainer stopped all local building and testing after the machine ran out of resource headroom, and directed that the residual campaign pull requests be consolidated into one with verification delegated to GitHub Actions CI. This unit's net diff is carried into #2266 as its own squashed commit, so its issue keeps a separate acceptance boundary, rollback unit, and failure attribution inside the shared pull request.

Closing this one. The branch is left in place; nothing is deleted.