{"record":{"id":"afdd402c1023a46d","repo":"apache/cassandra","slug":"invalid-size-for-output-buffer-outputlength","errorCode":null,"errorMessage":"invalid size for output buffer: ${outputLength}","messagePattern":"invalid size for output buffer: (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/utils/ByteBufferUtil.java","lineNumber":914,"sourceCode":"    {\n        BufferType bufferType = buf != null ? BufferType.typeOf(buf) : BufferType.ON_HEAP;\n        return ensureCapacity(buf, outputLength, allowBufferResize, bufferType);\n    }\n\n    /**\n     * Ensure {@code buf} is large enough for {@code outputLength}. If not, it is cleaned up and a new buffer is allocated;\n     * else; buffer has it's position/limit set appropriately.\n     *\n     * @param buf buffer to test the size of; may be null, in which case, a new buffer is allocated.\n     * @param outputLength the minimum target size of the buffer\n     * @param allowBufferResize true if resizing (reallocating) the buffer is allowed\n     * @param bufferType on- or off- heap byte buffer\n     * @return {@code buf} if it was large enough, else a newly allocated buffer.\n     */\n    public static ByteBuffer ensureCapacity(ByteBuffer buf, int outputLength, boolean allowBufferResize, BufferType bufferType)\n    {\n        if (0 > outputLength)\n            throw new IllegalArgumentException(\"invalid size for output buffer: \" + outputLength);\n        if (buf == null || buf.capacity() < outputLength)\n        {\n            if (!allowBufferResize)\n                throw new IllegalStateException(String.format(\"output buffer is not large enough for data: current capacity %d, required %d\", buf.capacity(), outputLength));\n            MemoryUtil.clean(buf);\n            buf = bufferType.allocate(outputLength);\n        }\n        else\n        {\n            buf.position(0).limit(outputLength);\n        }\n        return buf;\n    }\n\n    /**\n     * Check is the given buffer contains a given sub-buffer.\n     *\n     * @param buffer The buffer to search for sequence of bytes in.","sourceCodeStart":896,"sourceCodeEnd":932,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/utils/ByteBufferUtil.java#L896-L932","documentation":"IllegalArgumentException from ByteBufferUtil.ensureCapacity when the requested outputLength is invalid (e.g. negative). The guard fires before the resize-or-reallocate logic, since no buffer can satisfy a nonsensical target size; ${outputLength} is interpolated with the offending value.","triggerScenarios":"Calling ensureCapacity with a computed outputLength that underflowed (e.g., from a corrupted header, negative arithmetic, an int overflow, or a malformed serialized size read from a peer).","commonSituations":"Corrupt SSTable/network data yielding negative sizes; integer overflow in size computation; passing an unvalidated length parsed from untrusted bytes.","solutions":["Check the length computation for overflow/underflow (use long or Math.addExact)","Validate the size read from serialized input is non-negative before use","Treat corrupt-input cases as protocol/IO errors upstream; log the computed length","Fix the caller that computed the negative value"],"exampleFix":"// before\nint out = headerSize - consumed; // can go negative on corrupt data\nbuf = ByteBufferUtil.ensureCapacity(buf, out, true, bufferType);\n// after\nint out = headerSize - consumed;\nif (out < 0) throw new CorruptBlockException(\"negative output size\");\nbuf = ByteBufferUtil.ensureCapacity(buf, out, true, bufferType);","handlingStrategy":"validation","validationCode":"// validate computed size before ensureCapacity\nif (outputLength < 0)\n    throw new IllegalArgumentException(\"caller computed negative size: \" + outputLength + \", check for overflow/corrupt input\");","typeGuard":null,"tryCatchPattern":"try {\n    buf = ByteBufferUtil.ensureCapacity(buf, outputLength, allowResize, bufferType);\n} catch (IllegalArgumentException e) {\n    // log computed length and input source; treat as corrupt input\n}","preventionTips":["Use long arithmetic or Math.*Exact for size computations","Validate sizes parsed from serialized/network input","Fuzz size computations with malformed headers"],"tags":["bytebuffer","bounds","validation"],"backgroundTag":"value-out-of-range","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}