{"record":{"id":"834dad3fece14838","repo":"t8y2/dbx","slug":"negative-length-d-834dad","errorCode":null,"errorMessage":"negative length %d","messagePattern":"negative length (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":807,"sourceCode":"\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"kind: %w\", err)\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"service: %w\", err)\n\t}\n\tif reader.Len() != 0 {\n\t\treturn nil, nil, errors.New(\"token contains trailing data\")\n\t}\n\treturn identifier, password, nil\n}\n\nfunc readHadoopByteArray(reader io.ByteReader) ([]byte, error) {\n\tlength, err := readHadoopVInt(reader)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif length < 0 {\n\t\treturn nil, fmt.Errorf(\"negative length %d\", length)\n\t}\n\tif length > 64*1024*1024 {\n\t\treturn nil, fmt.Errorf(\"length %d exceeds limit\", length)\n\t}\n\tvalue := make([]byte, int(length))\n\tbyteReader, ok := reader.(io.Reader)\n\tif !ok {\n\t\treturn nil, errors.New(\"reader cannot read token payload\")\n\t}\n\tif _, err := io.ReadFull(byteReader, value); err != nil {\n\t\treturn nil, err\n\t}\n\treturn value, nil\n}\n\nfunc readHadoopVInt(reader io.ByteReader) (int64, error) {\n\tfirstByte, err := reader.ReadByte()\n\tif err != nil {","sourceCodeStart":789,"sourceCodeEnd":825,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L789-L825","documentation":"This error means a length-prefixed field inside the delegation token declared a negative length when decoded as a Hadoop VInt. The parser rejects negative lengths because byte arrays cannot have negative size, indicating a corrupt or non-Hadoop-format token. It is an internal guard in readHadoopByteArray.","triggerScenarios":"A delegation token whose VInt length bytes decode to a negative number, typically from random/invalid binary data or a wrong encoding passed as a token.","commonSituations":"Passing an arbitrary base64 string (JWT, API key) where a Hadoop delegation token is expected; bit-flipped or corrupted stored token.","solutions":["Confirm the credential is a genuine Hadoop Hive delegation token, not another token type","Re-fetch the token from the server's getDelegationToken API","Validate base64 decoding and byte integrity of the token"],"exampleFix":"// before\ntoken := jwtFromSSO() // wrong type\ncfg.SetDelegationToken(token)\n// after\ntoken := hs2DelegationTokenFromServer()\ncfg.SetDelegationToken(token)","handlingStrategy":"type-guard","validationCode":"func tokenLooksSane(token string) bool {\n\traw, err := base64.StdEncoding.DecodeString(token)\n\treturn err == nil && len(raw) > 0 && raw[0] >= 0\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"negative length\") {\n\treturn fmt.Errorf(\"credential is not a Hadoop delegation token: %w\", err)\n}","preventionTips":["Never substitute JWTs, API keys, or certs for Hadoop delegation tokens","Verify the token issuer is getDelegationToken on Hive/HDFS","Add a token-format preflight check before connecting"],"tags":["hive","delegation-token","serialization","vint"],"backgroundTag":"delegation-token-decode-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}