NationalSecurityAgency/ghidra · error · ElasticException

Bad encoding in result document

Error message

Bad encoding in result document

What it means

Thrown in queryNearestVector when an IOException is caught while decoding a feature vector from the Base64-encoded "features" field of a search-result _source document. The vectorFactory.restoreVectorFromBase64 call failed, meaning a stored vector document contains data that cannot be parsed back into an LSHVector.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticDatabase.java:878

		try {
			int returnedHits = hitsArray.size();
			for (int i = 0; i < returnedHits; ++i) {
				JsonObject mainHit = (JsonObject) hitsArray.get(i);
				VectorResult vecRes = new VectorResult();
				vecRes.vectorid = Base64Lite.decodeLongBase64(mainHit.get("_id").getAsString());
				vecRes.hitcount = -1;		// Cannot fill in at this time
				vecRes.sim = mainHit.get("_score").getAsDouble();
				JsonObject source = (JsonObject) mainHit.get("_source");
				StringReader reader = new StringReader(source.get("features").getAsString());
				vecRes.vec = vectorFactory.restoreVectorFromBase64(reader, decodeBuffer);
				vector.compareCounts(vecRes.vec, vecCompare);
				vecCompare.dotproduct = vecRes.sim * vector.getLength() * vecRes.vec.getLength();
				vecRes.signif = vectorFactory.calculateSignificance(vecCompare);
				listResult.add(vecRes);
			}
		}
		catch (IOException ex) {
			throw new ElasticException("Bad encoding in result document");
		}
		long totalCount = 0;
		Iterator<VectorResult> iter1 = listResult.iterator();
		Iterator<VectorResult> iter2 = listResult.iterator();
		while (iter1.hasNext()) {
			totalCount += fetchVectorCounts(iter1, iter2, MAX_VECTORCOUNT_WINDOW);
		}
		return totalCount;
	}

	/**
	 * Returns the total number of hits in the given list of VectorResults
	 * 
	 * @param listResult is the list of VectorResults
	 * @return the total count
	 */
	private int getTotalCount(List<VectorResult> listResult) {
		int count = 0;

View on GitHub (pinned to d5f144c24d)

Solutions

1. Identify the specific corrupted vector document by examining the hit _id values and query them individually via curl to inspect the raw features field.
2. Re-ingest the affected executable(s) to overwrite the corrupted vector documents with valid base64 data.
3. Check Elasticsearch cluster health (_cluster/health) for yellow/red status indicating shard or disk problems, and resolve any underlying storage issues.
4. If corruption is widespread, drop and recreate the database from the source executables using the generate command.

try {
    database.query(queryNearest);
} catch (ElasticException e) {
    if (e.getMessage().contains("Bad encoding in result document")) {
        // Data corruption — identify and re-ingest the affected executable
        Msg.error(this, "Corrupted vector data detected; consider re-ingesting affected executables");
    }
    throw e;
}

When it happens

Trigger: During queryNearestVector, iterating over the hitsArray from a vector/_search response. For one or more result hits, source.get("features").getAsString() yields a string that restoreVectorFromBase64 cannot decode, raising an IOException that is caught and re-thrown as this ElasticException.

Common situations: Database corruption from disk errors or interrupted writes; vector written by an incompatible BSim client version using a different base64 encoding scheme; Elasticsearch reindexing or dynamic-mapping changes that altered the features text field; partial shard recovery serving stale or corrupted segment data.

Related errors

• {}
• No functions matching vectorid:
• Error during vector deletion
• Unrecoverable error: Could not find configuration
• {getType()}scripts cannot be used for context [{context.name

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/255997f5b5720269. Report an issue: GitHub.