MuntashirAkon/AppManager · error · IllegalArgumentException

At offset ${offset}, ${length} byte binary number exceeds ma

Error message

At offset ${offset}, ${length} byte binary number exceeds maximum signed long value

What it means

TarUtils.parseBinaryLong throws this IllegalArgumentException when a GNU base-256 encoded numeric field is 9 or more bytes long, because a 9+ byte binary number cannot fit in a signed 64-bit Java long. The value represented by the header field exceeds Long.MAX_VALUE, so it cannot be returned as a long.

Source

Thrown at app/src/main/java/org/apache/commons/compress/archivers/tar/TarUtils.java:180

     */
    public static long parseOctalOrBinary(final byte[] buffer, final int offset,
                                          final int length) {

        if ((buffer[offset] & 0x80) == 0) {
            return parseOctal(buffer, offset, length);
        }
        final boolean negative = buffer[offset] == (byte) 0xff;
        if (length < 9) {
            return parseBinaryLong(buffer, offset, length, negative);
        }
        return parseBinaryBigInteger(buffer, offset, length, negative);
    }

    private static long parseBinaryLong(final byte[] buffer, final int offset,
                                        final int length,
                                        final boolean negative) {
        if (length >= 9) {
            throw new IllegalArgumentException("At offset " + offset + ", "
                                               + length + " byte binary number"
                                               + " exceeds maximum signed long"
                                               + " value");
        }
        long val = 0;
        for (int i = 1; i < length; i++) {
            val = (val << 8) + (buffer[offset + i] & 0xff);
        }
        if (negative) {
            // 2's complement
            val--;
            val ^= (long) Math.pow(2.0, (length - 1) * 8.0) - 1;
        }
        return negative ? -val : val;
    }

    private static long parseBinaryBigInteger(final byte[] buffer,
                                              final int offset,

View on GitHub (pinned to 0152f468fc)

Solutions

Treat the archive as invalid/unreadable and reject it before processing entries
Catch the IllegalArgumentException and skip or report the offending entry
Use PAX extended headers, which carry such values as decimal strings, and prefer parsing those when present
Pre-check the field's first byte for the base-256 marker and its length before calling parseOctalOrBinary

Example fix

// before
long size = TarUtils.parseOctalOrBinary(header, offset, TarConstants.SIZELEN); // throws for 9-byte binary
// after
long size;
try {
    size = TarUtils.parseOctalOrBinary(header, offset, TarConstants.SIZELEN);
} catch (IllegalArgumentException e) {
    throw new ArchiveException("Header field too large for long: " + e.getMessage());
}

Defensive patterns

Strategy: try-catch

Validate before calling

static boolean fieldFitsInLong(byte[] buffer, int offset, int length) {
    return length < 9 || (buffer[offset] & 0x80) == 0; // 9+ byte base-256 cannot fit in long
}

Try / catch

try {
    long value = TarUtils.parseOctalOrBinary(header, offset, length);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("exceeds maximum signed long")) {
        throw new ArchiveException("Numeric field at offset " + offset + " overflows long");
    }
    throw e;
}

Prevention

Treat long-overflowing fields as a sign of malicious/corrupt input and reject the archive
Pre-check field length (< 9 bytes for base-256) before parsing
Use PAX headers for archives that legitimately need large values
Bound-check parsed sizes/offsets before allocating memory or seeking

When it happens

Trigger: Parsing (via parseOctalOrBinary) a tar header field encoded in base-256 binary with length >= 9 bytes, i.e. a value too large for a signed long (>= 2^63); archives produced on systems with sizes/times beyond long range.

Common situations: Extremely large files (>8 exabytes in binary encoding form, or crafted archives); sparse or PAX headers carrying oversized numeric values; adversarial/fuzzed tar inputs.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

AI-assisted analysis of MuntashirAkon/AppManager@0152f468fc (2026-09-12). Data as JSON: /api/errors/7b95bdc1782729f6. Report an issue: GitHub.