{"record":{"id":"986c04bd6399cacc","repo":"vxcontrol/pentagi","slug":"file-s-has-invalid-size-d","errorCode":null,"errorMessage":"file '%s' has invalid size %d","messagePattern":"file '(.+?)' has invalid size (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/pkg/tools/terminal.go","lineNumber":409,"sourceCode":"\t\tif tarHeader.FileInfo().IsDir() {\n\t\t\tcontinue\n\t\t}\n\n\t\tif stats.Mode.IsDir() {\n\t\t\tbuffer.WriteString(\"--------------------------------------------------\\n\")\n\t\t\tbuffer.WriteString(\n\t\t\t\tfmt.Sprintf(\"'%s' file content (with size %d bytes) shown below:\\n\",\n\t\t\t\t\ttarHeader.Name, tarHeader.Size,\n\t\t\t\t),\n\t\t\t)\n\t\t}\n\n\t\tconst maxReadFileSize int64 = 100 * 1024 * 1024 // 100 MB limit\n\t\tif tarHeader.Size > maxReadFileSize {\n\t\t\treturn \"\", fmt.Errorf(\"file '%s' size %d exceeds maximum allowed size %d\", tarHeader.Name, tarHeader.Size, maxReadFileSize)\n\t\t}\n\t\tif tarHeader.Size < 0 {\n\t\t\treturn \"\", fmt.Errorf(\"file '%s' has invalid size %d\", tarHeader.Name, tarHeader.Size)\n\t\t}\n\n\t\tvar fileContent = make([]byte, tarHeader.Size)\n\t\t_, err = tarReader.Read(fileContent)\n\t\tif err != nil && err != io.EOF {\n\t\t\treturn \"\", fmt.Errorf(\"failed to read file '%s' content: %w\", tarHeader.Name, err)\n\t\t}\n\t\tbuffer.Write(fileContent)\n\n\t\tif stats.Mode.IsDir() {\n\t\t\tbuffer.WriteString(\"\\n\\n\")\n\t\t}\n\t}\n\n\treturn buffer.String(), nil\n}\n\nfunc (t *terminal) WriteFile(ctx context.Context, flowID int64, content string, path string) (string, error) {","sourceCodeStart":391,"sourceCodeEnd":427,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/tools/terminal.go#L391-L427","documentation":"Defensive check: a tar header with a negative Size is structurally invalid (tar sizes are non-negative octal fields), so attempting `make([]byte, tarHeader.Size)` would panic. The function rejects such a stream with this error before allocating. Reaching it means the tar reader produced a malformed header or a corrupted/custom stream was fed in.","triggerScenarios":"Only reachable when tarReader.Next() yields a header whose Size < 0 — practically impossible for well-formed Docker-generated tars; indicates a corrupted stream, a bug in a wrapping reader, or tampered/interposed transport.","commonSituations":"Bit-flip/corruption on a remote Docker TCP connection; a custom or older Docker daemon/registry layer emitting non-standard headers; fuzzing or adversarial input tests against the file-read path.","solutions":["Treat as data corruption: retry the whole CopyFromContainer read from scratch","Verify Docker daemon and client versions match on remote hosts; upgrade mismatched daemons","Check transport integrity (TLS, proxies) between client and daemon if using DOCKER_HOST over TCP","If it reproduces deterministically on one file, re-create the file inside the container (it may be a sparse/special file the daemon tars oddly)"],"exampleFix":"// before\nvar fileContent = make([]byte, tarHeader.Size)\n// after (already guarded in current code)\nif tarHeader.Size < 0 {\n    return \"\", fmt.Errorf(\"file '%s' has invalid size %d\", tarHeader.Name, tarHeader.Size)\n}\nvar fileContent = make([]byte, tarHeader.Size)","handlingStrategy":"type-guard","validationCode":"// Not preventable by the caller; guard the parsed header before allocation:\nif tarHeader.Size < 0 || tarHeader.Size > maxReadFileSize {\n    return fmt.Errorf(\"invalid tar entry size %d for %s\", tarHeader.Size, tarHeader.Name)\n}","typeGuard":"func validTarSize(h *tar.Header) bool {\n    return h != nil && h.Size >= 0\n}","tryCatchPattern":"content, err := tool.ReadFile(ctx, flowID, path)\nif err != nil && strings.Contains(err.Error(), \"has invalid size\") {\n    // treat as corruption: log and retry the whole read once\n    content, err = tool.ReadFile(ctx, flowID, path)\n}","preventionTips":["Retry the full CopyFromContainer read on any malformed-header error","Check Docker client/daemon version consistency on remote hosts","Inspect transport (TLS/proxies) for corruption when using DOCKER_HOST over TCP","Recreate suspicious files that reproducibly fail header parsing"],"tags":["docker","tar","data-corruption"],"backgroundTag":"corrupt-tar-archive","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}