{"record":{"id":"708afce6175b416b","repo":"t8y2/dbx","slug":"length-d-exceeds-limit","errorCode":null,"errorMessage":"length %d exceeds limit","messagePattern":"length (.+?) exceeds limit","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":807,"sourceCode":"\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"service: %w\", err)\n\t}\n\tif reader.Len() != 0 {\n\t\treturn nil, nil, errors.New(\"token contains trailing data\")\n\t}\n\treturn identifier, password, nil\n}\n\nfunc readHadoopByteArray(reader io.ByteReader) ([]byte, error) {\n\tlength, err := readHadoopVInt(reader)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif length < 0 {\n\t\treturn nil, fmt.Errorf(\"negative length %d\", length)\n\t}\n\tif length > 64*1024*1024 {\n\t\treturn nil, fmt.Errorf(\"length %d exceeds limit\", length)\n\t}\n\tvalue := make([]byte, int(length))\n\tbyteReader, ok := reader.(io.Reader)\n\tif !ok {\n\t\treturn nil, errors.New(\"reader cannot read token payload\")\n\t}\n\tif _, err := io.ReadFull(byteReader, value); err != nil {\n\t\treturn nil, err\n\t}\n\treturn value, nil\n}\n\nfunc readHadoopVInt(reader io.ByteReader) (int64, error) {\n\tfirstByte, err := reader.ReadByte()\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\tfirst := int8(firstByte)","sourceCodeStart":789,"sourceCodeEnd":825,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L789-L825","documentation":"This error is returned by the Hadoop delegation token byte-array reader when a field's length prefix exceeds the 64 MiB safety limit. The library caps parsed token fields to prevent unbounded memory allocation from corrupt or hostile input. It indicates the token is not a valid Hadoop delegation token or is badly misaligned.","triggerScenarios":"Decoding a token whose VInt length decodes to a value > 67108864 bytes — effectively only from random/garbage input or a non-token blob.","commonSituations":"Passing a large arbitrary string (e.g. a JWT or password) as a delegation token; corrupted base64 that misaligns the length parse.","solutions":["Confirm the delegationToken is a real Hadoop delegation token issued by Hive","Regenerate the token from the server","Do not pass other credential types (JWTs, passwords) in the delegationToken field","Base64-decode the token locally and sanity-check its size before use"],"exampleFix":"// before\ncfg.DelegationToken = myJWT\n// after\ncfg.DelegationToken = hiveDelegationToken","handlingStrategy":"validation","validationCode":"func tokenFieldLengthsSane(token string) error {\n\tdecoded, err := base64.StdEncoding.DecodeString(token)\n\tif err != nil { return err }\n\tconst maxField = 64 * 1024 * 1024\n\t_ = maxField // driver rejects any field length above 64MiB\n\tif len(decoded) > 64*1024*1024 {\n\t\treturn errors.New(\"token blob implausibly large — wrong credential type\")\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := applyToken(cfg, token); err != nil && strings.Contains(err.Error(), \"exceeds limit\") {\n\treturn fmt.Errorf(\"delegationToken is not a valid Hadoop token (field too large): %w\", err)\n}","preventionTips":["Sanity-check token size (< a few KB is typical) before passing to the driver","Keep credential types distinct in your config schema (typed fields, not strings)","Reject oversized secret values at config load time","Log token length, never token content, when debugging"],"tags":["hive","authentication","delegation-token","validation"],"backgroundTag":"invalid-delegation-token","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}