{"record":{"id":"1233990725163b9f","repo":"eclipse-vertx/vert.x","slug":"invalid-der-stream-too-short-missing-tag","errorCode":null,"errorMessage":"Invalid DER: stream too short, missing tag","messagePattern":"Invalid DER: stream too short, missing tag","errorType":"exception","errorClass":"VertxException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java","lineNumber":313,"sourceCode":"     * @param in The DER encoded stream\n     */\n    DerParser(Buffer in) throws VertxException {\n      this.in = in;\n    }\n\n    /**\n     * Create a new DER decoder from a byte array.\n     *\n     * @param bytes The encoded bytes\n     * @throws VertxException\n     */\n    DerParser(byte[] bytes) throws VertxException {\n      this(Buffer.buffer(bytes));\n    }\n\n    private int readByte() throws VertxException {\n      if (pos + 1 >= in.length()) {\n        throw new VertxException(\"Invalid DER: stream too short, missing tag\");\n      }\n      return in.getUnsignedByte(pos++);\n    }\n\n    private byte[] readBytes(int len) throws VertxException {\n      if (pos + len > in.length()) {\n        throw new VertxException(\"Invalid DER: stream too short, missing tag\");\n      }\n      Buffer s = in.slice(pos, pos + len);\n      pos += len;\n      return s.getBytes();\n    }\n\n    /**\n     * Read next object. If it's constructed, the value holds\n     * encoded content and it should be parsed by a new\n     * parser from {@code Asn1Object.getParser}.\n     *","sourceCodeStart":295,"sourceCodeEnd":331,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java#L295-L331","documentation":"Thrown by DerParser.readByte when the input buffer is exhausted (pos+1 >= length) but another tag byte is requested. This means the DER stream ended mid-structure — the key bytes are truncated or the length fields promise more data than is present.","triggerScenarios":"Parsing key bytes cut off before the end (wrong slice length, string truncated at a newline); any DER read operation reaching EOF, reached via tag/read paths.","commonSituations":"Manually splitting PEM base64 into the wrong byte range; files truncated by upload/download; copying key text that lost trailing lines.","solutions":["Re-extract the base64 body with the complete PEM block and re-decode; compare byte length against openssl asn1parse output.","Regenerate/re-download the key file and verify integrity (checksum or openssl pkey -check / openssl rsa -check).","Confirm no code truncates the buffer (e.g. substring, fixed-size slice, or Buffer.slice with wrong end index).","Validate the DER end-to-end with openssl asn1parse -inform DER before passing it to the parser."],"exampleFix":"// before\nbyte[] der = Base64.getMimeDecoder().decode(body.substring(0, body.indexOf('\\n', 64)));\n// after\nbyte[] der = Base64.getMimeDecoder().decode(body.trim());","handlingStrategy":"validation","validationCode":"// Verify completeness before parsing\nbyte[] der = Base64.getMimeDecoder().decode(fullPemBody);\nif (der.length < 8) throw new IllegalArgumentException(\"Key material too short\");\n// cross-check expected size: openssl asn1parse -inform DER -in key.der must consume the whole input","typeGuard":null,"tryCatchPattern":"try {\n    return PrivateKeyParser.getECKeySpec(der);\n} catch (VertxException e) {\n    if (e.getMessage().contains(\"stream too short\")) {\n        throw new KeyFormatException(\"Key material truncated: \" + e.getMessage());\n    }\n    throw e;\n}","preventionTips":["Decode the entire PEM body, never a fixed-size slice","Verify file checksums after transfer","Test key integrity with openssl rsa -check / openssl ec -check at startup"],"tags":["der","asn1","truncated","eof","pem"],"backgroundTag":"invalid-argument-format","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}