{"record":{"id":"92b86d82383ec16a","repo":"grpc/grpc-java","slug":"invalid-initial-window-size-newwindowsize","errorCode":null,"errorMessage":"Invalid initial window size: ${newWindowSize}","messagePattern":"Invalid initial window size: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"okhttp/src/main/java/io/grpc/okhttp/OutboundFlowController.java","lineNumber":61,"sourceCode":"  public OutboundFlowController(Transport transport, FrameWriter frameWriter) {\n    this.transport = Preconditions.checkNotNull(transport, \"transport\");\n    this.frameWriter = Preconditions.checkNotNull(frameWriter, \"frameWriter\");\n    this.initialWindowSize = DEFAULT_WINDOW_SIZE;\n    connectionState = new StreamState(CONNECTION_STREAM_ID, DEFAULT_WINDOW_SIZE, null);\n  }\n\n  /**\n   * Adjusts outbound window size requested by peer. When window size is increased, it does not send\n   * any pending frames. If this method returns {@code true}, the caller should call {@link\n   * #writeStreams()} after settings ack.\n   *\n   * <p>Must be called with holding transport lock.\n   *\n   * @return true, if new window size is increased, false otherwise.\n   */\n  public boolean initialOutboundWindowSize(int newWindowSize) {\n    if (newWindowSize < 0) {\n      throw new IllegalArgumentException(\"Invalid initial window size: \" + newWindowSize);\n    }\n\n    int delta = newWindowSize - initialWindowSize;\n    initialWindowSize = newWindowSize;\n    for (StreamState state : transport.getActiveStreams()) {\n      state.incrementStreamWindow(delta);\n    }\n\n    return delta > 0;\n  }\n\n  /**\n   * Update the outbound window for given stream, or for the connection if stream is null. Returns\n   * the new value of the window size.\n   *\n   * <p>Must be called with holding transport lock.\n   */\n  public int windowUpdate(@Nullable StreamState state, int delta) {","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/okhttp/src/main/java/io/grpc/okhttp/OutboundFlowController.java#L43-L79","documentation":"OutboundFlowController.initialOutboundWindowSize sets the HTTP/2 connection-level outbound window and validates the new size. A negative value is a programming error, so it throws IllegalArgumentException 'Invalid initial window size: <n>'.","triggerScenarios":"Calling initialOutboundWindowSize with a negative int, or code (e.g. from SETTINGS_WINDOW_UPDATE handling) passing a parsed value that underflowed/negative into this method.","commonSituations":"Custom transport wiring or tests feeding unvalidated HTTP/2 SETTINGS values; integer parsing mistakes when handling peer SETTINGS frames.","solutions":["Validate the window size is >= 0 before calling (and realistically within HTTP/2 max 2^31-1)","Check the code computing the new size for sign/parse errors","Clamp peer-advertised SETTINGS_INITIAL_WINDOW_SIZE values to valid range before applying"],"exampleFix":"// before\ncontroller.initialOutboundWindowSize(size);\n// after\nif (size >= 0 && size <= Integer.MAX_VALUE) { controller.initialOutboundWindowSize(size); }","handlingStrategy":"validation","validationCode":"if (newWindowSize < 0 || newWindowSize > Integer.MAX_VALUE) throw new IllegalArgumentException(\"window size out of range: \" + newWindowSize);","typeGuard":null,"tryCatchPattern":"try { controller.initialOutboundWindowSize(size); }\ncatch (IllegalArgumentException e) { /* clamp size and retry */ controller.initialOutboundWindowSize(Math.max(0, size)); }","preventionTips":["Validate HTTP/2 SETTINGS values parsed from peers before applying them","Bound window sizes to the HTTP/2 maximum (2^31 - 1)","Add assertions in transport code around window-size arithmetic"],"tags":["grpc","java","http2","flow-control","illegal-argument"],"backgroundTag":"value-out-of-range","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}