{"record":{"id":"5f132cf0a8709e17","repo":"t8y2/dbx","slug":"zookeeper-sasl-token-length-d-is-invalid","errorCode":null,"errorMessage":"ZooKeeper SASL token length %d is invalid","messagePattern":"ZooKeeper SASL token length (.+?) is invalid","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/zookeeper/sasl.go","lineNumber":148,"sourceCode":"\t\treturn nil, err\n\t}\n\tif len(response) < 20 {\n\t\treturn nil, errors.New(\"ZooKeeper SASL response is truncated\")\n\t}\n\tresponseXID := int32(binary.BigEndian.Uint32(response[4:8]))\n\tif responseXID != xid {\n\t\treturn nil, fmt.Errorf(\"ZooKeeper SASL response xid %d does not match request xid %d\", responseXID, xid)\n\t}\n\terrorCode := int32(binary.BigEndian.Uint32(response[16:20]))\n\tif errorCode != 0 {\n\t\treturn nil, fmt.Errorf(\"ZooKeeper SASL server returned error %d\", errorCode)\n\t}\n\tif len(response) < 24 {\n\t\treturn nil, errors.New(\"ZooKeeper SASL token is truncated\")\n\t}\n\ttokenLength := int(int32(binary.BigEndian.Uint32(response[20:24])))\n\tif tokenLength < 0 || tokenLength > zooKeeperMaximumFrameLen || 24+tokenLength > len(response) {\n\t\treturn nil, fmt.Errorf(\"ZooKeeper SASL token length %d is invalid\", tokenLength)\n\t}\n\treturn append([]byte(nil), response[24:24+tokenLength]...), nil\n}\n\nfunc readZooKeeperFrame(reader io.Reader) ([]byte, error) {\n\theader := make([]byte, 4)\n\tif _, err := io.ReadFull(reader, header); err != nil {\n\t\treturn nil, err\n\t}\n\tlength := int(int32(binary.BigEndian.Uint32(header)))\n\tif length < 0 || length > zooKeeperMaximumFrameLen {\n\t\treturn nil, fmt.Errorf(\"ZooKeeper frame length %d is invalid\", length)\n\t}\n\tpayload := make([]byte, length+4)\n\tcopy(payload, header)\n\tif _, err := io.ReadFull(reader, payload[4:]); err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/zookeeper/sasl.go#L130-L166","documentation":"The SASL response carries a token length at bytes 20:24. zooKeeperSASLRound validates it: negative, larger than zooKeeperMaximumFrameLen, or extending past the received payload makes the response unusable, and this error names the offending length. It protects against corrupt or malicious replies causing invalid slices.","triggerScenarios":"zooKeeperSASLRound parses a response whose tokenLength field is negative, exceeds zooKeeperMaximumFrameLen, or where 24+tokenLength > len(response) — a truncated or corrupted SASL token.","commonSituations":"Corrupted stream from a misbehaving proxy, a server bug emitting a short frame, or a test fake constructing a malformed token; also caused by earlier frame misalignment from missed bytes.","solutions":["Reconnect and restart the SASL handshake — the stream is likely corrupted or truncated.","Inspect intermediate proxies/LBs that may truncate or rewrite payloads.","If using a mock server, write the correct token length and the matching number of token bytes.","Ensure no other reader is consuming bytes from the connection concurrently, causing short reads."],"exampleFix":"// before (fake server)\nbinary.BigEndian.PutUint32(resp[20:24], uint32(999999))\n// after\nbinary.BigEndian.PutUint32(resp[20:24], uint32(len(token)))\nresp = append(resp, token...)","handlingStrategy":"validation","validationCode":"func validSASLResponse(resp []byte) bool {\n\tif len(resp) < 24 { return false }\n\ttl := int(int32(binary.BigEndian.Uint32(resp[20:24])))\n\treturn tl >= 0 && tl <= zooKeeperMaximumFrameLen && 24+tl <= len(resp)\n}","typeGuard":null,"tryCatchPattern":"token, err := zooKeeperSASLRound(conn, xid, token)\nif err != nil {\n\tconn.Close() // framing corruption: connection is unusable\n\treturn fmt.Errorf(\"sasl round failed: %w\", err)\n}","preventionTips":["Prefer strict length validation before any slicing of server responses.","Drop the connection on any framing anomaly — bytes are misaligned.","Test fake servers should compute the length field from the actual token."],"tags":["sasl","protocol","validation","zookeeper"],"backgroundTag":"sasl-token-invalid-length","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}