{"record":{"id":"5b6d224a4674e07c","repo":"apache/cassandra","slug":"invalid-bytebuf-length-length","errorCode":null,"errorMessage":"Invalid ByteBuf length \" + length","messagePattern":"Invalid ByteBuf length \" \\+ length","errorType":"exception","errorClass":"org.apache.cassandra.transport.ProtocolException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/transport/CBUtil.java","lineNumber":496,"sourceCode":"\n        ByteBuffer buffer = cb.nioBuffer(cb.readerIndex(), length);\n        cb.skipBytes(length);\n        return buffer;\n    }\n\n    public static ByteBuffer readBoundValue(ByteBuf cb, ProtocolVersion protocolVersion)\n    {\n        int length = cb.readInt();\n        if (length < 0)\n        {\n            if (protocolVersion.isSmallerThan(ProtocolVersion.V4)) // backward compatibility for pre-version 4\n                return null;\n            if (length == -1)\n                return null;\n            else if (length == -2)\n                return ByteBufferUtil.UNSET_BYTE_BUFFER;\n            else\n                throw new ProtocolException(\"Invalid ByteBuf length \" + length);\n        }\n        return ByteBuffer.wrap(readRawBytes(cb, length));\n    }\n\n    public static void writeValue(byte[] bytes, ByteBuf cb)\n    {\n        if (bytes == null)\n        {\n            cb.writeInt(-1);\n            return;\n        }\n\n        cb.writeInt(bytes.length);\n        cb.writeBytes(bytes);\n    }\n\n    public static void writeValue(ByteBuffer bytes, ByteBuf cb)\n    {","sourceCodeStart":478,"sourceCodeEnd":514,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/transport/CBUtil.java#L478-L514","documentation":"CBUtil.readValue(ByteBuf) treats a 4-byte length of -1 as null and -2 as the UNSET sentinel; any other negative length is invalid and throws ProtocolException \"Invalid ByteBuf length <n>\". Positive lengths are read normally. This rejects lengths outside the protocol's defined [-2, MAX] domain.","triggerScenarios":"A serialized value field carries a length < -2 (e.g., corrupt int, bit-flipped frame, or misaligned read landing on non-length bytes).","commonSituations":"Stream desync after an earlier malformed message; memory corruption or buggy client writing garbage lengths; parsing compressed vs uncompressed frames inconsistently.","solutions":["Fix the sender so value lengths are only >=0, -1 (null), or -2 (unset)","Reconnect the session to resync the stream","Verify compression negotiation (lz4/snappy) matches on both ends","Capture frames to locate where the byte stream diverges"],"exampleFix":"// before\nbuf.writeInt(-3); // invalid sentinel\n// after\nbuf.writeInt(-1); // null, or -2 for UNSET, or >=0 payload length","handlingStrategy":"validation","validationCode":"boolean isValidValueLength(int len) { return len >= 0 || len == -1 || len == -2; }","typeGuard":"boolean isValidSentinel(int length) { return length == -1 || length == -2; }","tryCatchPattern":"try { ... } catch (ProtocolException e) { if (e.getMessage().startsWith(\"Invalid ByteBuf length\")) { reconnectSession(); } else throw e; }","preventionTips":["Only emit lengths of -1, -2, or >=0 in custom frames","Resync/reconnect after any framing error","Verify compression negotiation to avoid parsing garbage lengths"],"tags":["cql-protocol","values","framing"],"backgroundTag":"unexpected-response-shape","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}