NationalSecurityAgency/ghidra · error · IllegalArgumentException

TaintVecs must match in length

Error message

TaintVecs must match in length

What it means

TaintVec.zip performs an element-wise combination result[n] = this[n] op that[n], so both input vectors must have identical length to keep indices aligned. A length mismatch throws IllegalArgumentException. This guards every binary taint op (union/intersection of two operand vectors).

Source

Thrown at Ghidra/Debug/TaintAnalysis/src/main/java/ghidra/taint/model/TaintVec.java:213

		return this;
	}

	/**
	 * Perform an operation on each same-indexed element from this and another vector, forming a
	 * third result vector
	 * 
	 * <p>
	 * In essence return, a vector where {@code result[n] = this[n] op that[n]}. The two input
	 * vectors must match in length.
	 * 
	 * @param that the other vector
	 * @param op the operation to apply
	 * @return the result
	 */
	private TaintVec zip(TaintVec that, BinaryOperator<TaintSet> op) {
		final int length = this.sets.length;
		if (length != that.sets.length) {
			throw new IllegalArgumentException("TaintVecs must match in length");
		}
		TaintVec vec = new TaintVec(length);
		for (int i = 0; i < length; i++) {
			vec.sets[i] = op.apply(this.sets[i], that.sets[i]);
		}
		return vec;
	}

	/**
	 * Perform an operation on a given taint set and each element from this array, forming a result
	 * vector
	 * 
	 * <p>
	 * In essence, return a vector where {@code result[n] = this[n] op set}.
	 * 
	 * @param set the taint set
	 * @param op the operation to apply
	 * @return the result

View on GitHub (pinned to d5f144c24d)

Solutions

1. Ensure both operands share the same byte length (use TaintVec.empties(n) and a correctly-sized fromConst).
2. Broadcast or extend the shorter vector to match the longer one before combining.
3. Trace the producing pcode op to confirm the input sizes and fix upstream sizing.

Example fix

// before
TaintVec sum = a.zip(b, TaintSet::union); // throws if a.length != b.length
// after
int n = Math.max(a.length, b.length);
TaintVec ae = a.extend(n);
TaintVec be = b.extend(n);
TaintVec sum = ae.zip(be, TaintSet::union);

if (a.length != b.length) {
    // extend/broadcast before combining
    int n = Math.max(a.length, b.length);
    a = a.extend(n);
    b = b.extend(n);
}

When it happens

Trigger: Applying a binary taint operation to two TaintVecs whose internal sets[] arrays differ in length - e.g. operands of different byte sizes, or a constant that wasn't broadcast/extended to the right length before the op.

Common situations: Mismatched operand sizes from pcode (adding an 8-byte vec to a 4-byte vec); a fromConst that produced the wrong element count; a vectorization/extension bug that left operands unequal in length.

Related errors

• Not supported
• Cannot make taint concrete
• Cannot make Taint concrete
• Timed out reading or writing target
• Error reading or writing target

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/4834978bf2b4881d. Report an issue: GitHub.