{"record":{"id":"9da98b35bec816c1","repo":"elastic/elasticsearch","slug":"invalid-der-length-larger-than-max-int","errorCode":null,"errorMessage":"Invalid DER: length larger than max-int","messagePattern":"Invalid DER: length larger than max-int","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java","lineNumber":143,"sourceCode":"\n        int i = derInputStream.read();\n        if (i == -1) throw new IOException(\"Invalid DER: length missing\");\n\n        // A single byte short length\n        if ((i & ~0x7F) == 0) return i;\n\n        int num = i & 0x7F;\n\n        // We can't handle length longer than 4 bytes\n        if (i >= 0xFF || num > 4) throw new IOException(\"Invalid DER: length field too big (\" + i + \")\"); //$NON-NLS-2$\n\n        byte[] bytes = new byte[num];\n        int n = derInputStream.read(bytes);\n        if (n < num) throw new IOException(\"Invalid DER: length too short\");\n\n        int len = new BigInteger(1, bytes).intValue();\n        if (len < 0) {\n            throw new IOException(\"Invalid DER: length larger than max-int\");\n        }\n\n        return len;\n    }\n\n    /**\n     * An ASN.1 TLV. The object is not parsed. It can\n     * only handle integers.\n     *\n     * @author zhang\n     */\n    public static class Asn1Object {\n\n        protected final int type;\n        protected final int length;\n        protected final byte[] value;\n        protected final int tag;\n","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java#L125-L161","documentation":"Thrown by DerParser.getLength() after BigInteger(1, bytes).intValue() returns a negative number. intValue() truncates a BigInteger to 32 bits; if the real value exceeds Integer.MAX_VALUE the truncated int can be negative, signalling a length that cannot be represented as a Java int.","triggerScenarios":"Long-form length bytes decode to a BigInteger larger than 2^31-1. The value() check `len < 0` catches the truncation. Encountered on DER whose length field encodes a multi-gigabyte object — almost always corruption, since real key material is far smaller.","commonSituations":"Corrupted length octets, random bytes presented as DER, or a malformed file where the parser is misaligned (e.g. wrong byte interpreted as a length because earlier elements were skipped).","solutions":["Treat this as corruption: re-export the key from the source.","Hex-dump the region and confirm length octets are within expected ranges (key DER is typically < 4 KiB).","If you are programmatically building DER, ensure length encoding never exceeds int range — split large payloads if needed.","Run `openssl asn1parse -inform DER -in key.der` to locate the malformed element."],"exampleFix":"// before: corrupted length bytes (0x84 0x80 0x00 0x00 0x00 = 2 GiB)\nbyte[] bad = hexToBytes(\"308480000000\");\nnew DerParser(bad).readAsn1Object();\n\n// after: re-export the key cleanly\n// openssl pkey -in corrupted.pem -out clean.pem\nbyte[] good = Files.readAllBytes(Path.of(\"clean.der\"));\nnew DerParser(good).readAsn1Object();","handlingStrategy":"validation","validationCode":"private static void requireIntRangeLength(byte[] der, int idx, int num) {\n    long len = 0;\n    for (int i = 0; i < num; i++) len = (len << 8) | (der[idx + i] & 0xFF);\n    if (len > Integer.MAX_VALUE) {\n        throw new IllegalArgumentException(\"declared length \" + len + \" exceeds Integer.MAX_VALUE; likely corruption\");\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Cap accepted lengths to a sane maximum (e.g. 64 KiB) for key material.","Treat multi-gigabyte length declarations as corruption by default.","Use `openssl asn1parse` to validate structure before parsing in code."],"tags":["ssl","der","asn1","keystore","elasticsearch","crypto"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}