[linhongyu510]

Problem

ConsumeVarint diverged from the reference google.golang.org/protobuf/encoding/protowire decoder:

1. No 10-byte cap. The loop reads continuation bytes indefinitely. At i=10+, i*7 >= 70\], and Go's unsigned shift wraps modulo 64, so later bytes OR stray bits into already-populated positions of v`.

2. No 10th-byte value check. The reference requires the 10th byte's lower 7 bits to be 0 or 1 (only bit 63 can be set in a 64-bit varint). FastPB accepted any value.

Reproduction (before fix)

Input	fastpb	protowire reference
[0x80×9, 0x02] (10B, b[9]=2)	(v=0, n=10) accepted	(v=0, n=-3) overflow
[0x80×9, 0x7f] (10B, b[9]=127)	(v=2^63, n=10) wrong value	(v=0, n=-3) overflow
[0x80×10, 0x01] (11B)	(v=0, n=11) accepted	(v=0, n=-3) overflow
[0x80×9, 0x01] (max uint64)	(v=2^63, n=10)	(v=2^63, n=10) ✓ match

Fix

Limit the scan loop to the first 9 bytes (the hot path for all field tags and most values), then check the 10th byte separately. The 10th byte can only contribute bit 63 (value 0 or 1); any larger value or a 10th continuation byte returns -3 (errCodeOverflow).

This matches the reference protowire structure: the short-path loop body is unchanged from the original (no extra per-iteration comparison).

Performance

Benchstat (3 runs each, Apple M5 Pro / arm64, 2s benchtime):

Input	base (ns/op)	fix (ns/op)	delta
tag (1 byte)	0.645	0.605	-6.2%
tag (2 bytes)	0.993	0.929	-6.4%
varint (1 byte)	0.633	0.608	-4.0%
varint (5 bytes)	2.234	2.045	-8.5%
valid 10-byte max	4.268	3.784	-11.3%
invalid 10-byte overflow	4.215	3.688	-12.5%

No hot-path regression. The i < 9 loop bound gives the compiler a known small trip count, which improves codegen.

Verification

• go build ./... clean (amd64, arm64, 386)
• go vet clean
• go test . all pass
• go test -race . clean
• Revert proof: restoring original wire.go fails all 3 overflow subcases
• Pure Go, no assembly, no platform-specific code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}