{"record":{"id":"aa6b8fa24c9c0f36","repo":"apache/cassandra","slug":"unexpected-extraneous-bytes-after-set-value","errorCode":null,"errorMessage":"Unexpected extraneous bytes after set value","messagePattern":"Unexpected extraneous bytes after set value","errorType":"validation","errorClass":"MarshalException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/serializers/SetSerializer.java","lineNumber":86,"sourceCode":"    }\n\n    @Override\n    public <V> void validate(V input, ValueAccessor<V> accessor)\n    {\n        if (accessor.isEmpty(input))\n            throw new MarshalException(\"Not enough bytes to read a set\");\n        try\n        {\n            int n = readCollectionSize(input, accessor);\n            int offset = sizeOfCollectionSize();\n            for (int i = 0; i < n; i++)\n            {\n                V value = readNonNullValue(input, accessor, offset);\n                offset += sizeOfValue(value, accessor);\n                elements.validate(value, accessor);\n            }\n            if (!accessor.isEmptyFromOffset(input, offset))\n                throw new MarshalException(\"Unexpected extraneous bytes after set value\");\n        }\n        catch (BufferUnderflowException | IndexOutOfBoundsException e)\n        {\n            throw new MarshalException(\"Not enough bytes to read a set\");\n        }\n    }\n\n    @Override\n    public <V> Set<T> deserialize(V input, ValueAccessor<V> accessor)\n    {\n        try\n        {\n            int n = readCollectionSize(input, accessor);\n            int offset = sizeOfCollectionSize();\n\n            if (n < 0)\n                throw new MarshalException(\"The data cannot be deserialized as a set\");\n","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/serializers/SetSerializer.java#L68-L104","documentation":"SetSerializer.validate decodes the declared number of elements and then checks that no bytes remain after the last element. Leftover bytes mean the buffer is longer than the encoded set it claims to hold, so the value is rejected as malformed. This keeps corrupt or wrongly-sized data from entering the database.","triggerScenarios":"Validating a buffer with trailing garbage, concatenating two serialized sets, or passing bytes whose size prefix undercounts the real element count relative to buffer length (e.g. buffer padded or holding another value appended).","commonSituations":"Manual byte-buffer slicing off-by-one errors; application code appending extra bytes; corrupt storage payload surfaced during validation; test harnesses building buffers by hand.","solutions":["Re-serialize the set with SetSerializer.serialize instead of assembling bytes manually.","Trim the buffer to the exact serialized length (duplicate + limit) before validating.","Check the code path that produced the buffer for slicing/concatenation bugs.","Catch MarshalException and treat the value as invalid/corrupt."],"exampleFix":"// before\nByteBuffer padded = ByteBuffer.allocate(serialized.remaining() + 8);\npadded.put(serialized);\nsetSerializer.validate(padded, ByteBufferAccessor.instance);\n// after\nsetSerializer.validate(serialized.duplicate(), ByteBufferAccessor.instance);","handlingStrategy":"validation","validationCode":"// Java\nByteBuffer dup = buf.duplicate();\nsetSerializer.validate(dup, ByteBufferAccessor.instance); // rejects trailing bytes","typeGuard":null,"tryCatchPattern":"try {\n    setSerializer.validate(buf.duplicate(), ByteBufferAccessor.instance);\n} catch (MarshalException e) {\n    log.warn(\"Set value malformed: {}\", e.getMessage());\n}","preventionTips":["Never concatenate or pad serialized collection buffers","Slice buffers to exact serialized lengths","Re-serialize collections instead of hand-assembling bytes"],"tags":["cassandra","serialization","set","validation"],"backgroundTag":"invalid-argument-format","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}