MuntashirAkon/AppManager · error · IllegalArgumentException

Length ${length} must be at least 2

Error message

Length ${length} must be at least 2

What it means

TarUtils.parseOctal requires a field of at least 2 bytes because a valid octal field needs at least one digit plus a terminator (space/NUL); shorter slices cannot be valid tar numeric fields. The library throws IllegalArgumentException when handed a length < 2. It indicates a malformed or mis-read tar header offset/length, since every standard tar numeric field is several bytes wide.

Source

Thrown at app/src/main/java/org/apache/commons/compress/archivers/tar/TarUtils.java:106

     * (this allows for missing fields).</p>
     *
     * <p>To work-around some tar implementations that insert a
     * leading NUL this method returns 0 if it detects a leading NUL
     * since Commons Compress 1.4.</p>
     *
     * @param buffer The buffer from which to parse.
     * @param offset The offset into the buffer from which to parse.
     * @param length The maximum number of bytes to parse - must be at least 2 bytes.
     * @return The long value of the octal string.
     * @throws IllegalArgumentException if the trailing space/NUL is missing or if a invalid byte is detected.
     */
    public static long parseOctal(final byte[] buffer, final int offset, final int length) {
        long    result = 0;
        int     end = offset + length;
        int     start = offset;

        if (length < 2){
            throw new IllegalArgumentException("Length "+length+" must be at least 2");
        }

        if (buffer[start] == 0) {
            return 0L;
        }

        // Skip leading spaces
        while (start < end){
            if (buffer[start] == ' '){
                start++;
            } else {
                break;
            }
        }

        // Trim all trailing NULs and spaces.
        // The ustar and POSIX tar specs require a trailing NUL or
        // space but some implementations use the extra digit for big

View on GitHub (pinned to 0152f468fc)

Solutions

  1. Fix the length passed to parseOctal to match the tar spec field size (e.g. SIZELEN=12, CHKSUMLEN=8, DEVLEN=8)
  2. Verify the header offset is correct — a misaligned offset makes the field read start/end land wrongly
  3. Use parseOctalOrBinary if the archive may use GNU base-256 encoding; but never with length<2
  4. Validate the buffer slice is a real tar header field before parsing

Example fix

// before
long size = TarUtils.parseOctal(header, 124, 2);
// after
long size = TarUtils.parseOctal(header, TarConstants.SIZE_OFFSET, TarConstants.SIZELEN);
Defensive patterns

Strategy: validation

Validate before calling

public static long safeParseOctal(byte[] buffer, int offset, int length) {
    if (buffer == null || length < 2 || offset + length > buffer.length) {
        throw new IllegalArgumentException("Field slice too small: offset=" + offset + " length=" + length);
    }
    return TarUtils.parseOctal(buffer, offset, length);
}

Type guard

static boolean validFieldSlice(byte[] buffer, int offset, int length) {
    return buffer != null && length >= 2 && offset >= 0 && offset + length <= buffer.length;
}

Try / catch

try {
    long value = TarUtils.parseOctal(header, offset, fieldLen);
} catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("Length ")) {
        throw new MalformedArchiveException("Tar numeric field shorter than 2 bytes at offset " + offset);
    }
    throw e;
}

Prevention

When it happens

Trigger: Calling TarUtils.parseOctal(buffer, offset, length) with length 0 or 1; corrupt or hand-crafted headers where numeric fields were sliced with wrong lengths (e.g. checksum, size, mtime fields shorter than the 8/12-byte tar spec).

Common situations: Parsing a tar file with a manually implemented header reader that uses wrong field offsets; fuzzed/corrupted archives; passing the wrong constants (not TarConstants.SIZELEN/CHKSUMLEN etc.) to parseOctal directly.

Related errors

AI-assisted analysis of MuntashirAkon/AppManager@0152f468fc (2026-09-12). Data as JSON: /api/errors/c58f23c63100690d. Report an issue: GitHub.