NationalSecurityAgency/ghidra · error · IllegalArgumentException

length < 0

Error message

length < 0

What it means

Thrown by FlatDebuggerAPI.safeRange(start, length) when the supplied length is negative. safeRange creates an address range, truncating to avoid overflow, but a negative length is a programming error, not an overflow.

Source

Thrown at Ghidra/Debug/Debugger-api/src/main/java/ghidra/debug/flatapi/FlatDebuggerAPI.java:793

		TraceSchedule time = current.getTime();
		TraceSchedule patched = time.patched(requireThread(thread), platform.getLanguage(), sleigh);
		return emulate(platform, patched, monitor);
	}

	/**
	 * Create an address range, avoiding address overflow by truncating
	 * 
	 * <p>
	 * If the length would cause address overflow, it is adjusted such that the range's maximum
	 * address is the space's maximum address.
	 * 
	 * @param start the minimum address
	 * @param length the desired length
	 * @return the range
	 */
	default AddressRange safeRange(Address start, int length) {
		if (length < 0) {
			throw new IllegalArgumentException("length < 0");
		}
		long maxLength = start.getAddressSpace().getMaxAddress().subtract(start);
		try {
			return new AddressRangeImpl(start, MathUtilities.unsignedMin(length, maxLength));
		}
		catch (AddressOverflowException e) {
			throw new AssertionError(e);
		}
	}

	/**
	 * The target service
	 * 
	 * @return the service
	 */
	default DebuggerTargetService getTargetService() {
		return requireService(DebuggerTargetService.class);
	}

View on GitHub (pinned to d5f144c24d)

Solutions

1. Validate length >= 0 before calling safeRange().
2. Fix the length computation (e.g., use Math.abs or correct the bound order).
3. Guard the caller's arithmetic so the difference cannot go negative.

Example fix

// before
AddressRange r = safeRange(start, end.subtract(start)); // throws if end<start

// after
long len = end.subtract(start);
if (len < 0) {
    println("end before start");
    return;
}
AddressRange r = safeRange(start, (int) len);

if (length < 0) {
    println("length must be >= 0");
    return;
}

try {
    AddressRange r = safeRange(start, length);
} catch (IllegalArgumentException e) {
    if (e.getMessage().equals("length < 0")) {
        // fix the length computation and retry
    } else throw e;
}

When it happens

Trigger: Calling safeRange(addr, len) where len < 0.

Common situations: Computing length as a difference (end - start) that went negative due to swapped bounds; off-by-one or underflow in size calculation; passing an unvalidated user input as length.

Related errors

• One or more invalid register names: {}
• Invalid register name: {}
• Missing required parameter '%s' (%s)
• Missing required parameter '{key}'
• Extra argument '{key}'

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/4250f6beee879cc9. Report an issue: GitHub.