{"record":{"id":"b8ef68ac3507dd84","repo":"apache/flink","slug":"length-may-not-be-negative","errorCode":null,"errorMessage":"Length may not be negative.","messagePattern":"Length may not be negative\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"flink-core/src/main/java/org/apache/flink/core/memory/DataInputDeserializer.java","lineNumber":178,"sourceCode":"    public void readFully(@Nonnull byte[] b) throws IOException {\n        readFully(b, 0, b.length);\n    }\n\n    @Override\n    public void readFully(@Nonnull byte[] b, int off, int len) throws IOException {\n        if (len >= 0) {\n            if (off <= b.length - len) {\n                if (this.position <= this.end - len) {\n                    System.arraycopy(this.buffer, position, b, off, len);\n                    position += len;\n                } else {\n                    throw new EOFException();\n                }\n            } else {\n                throw new ArrayIndexOutOfBoundsException();\n            }\n        } else {\n            throw new IllegalArgumentException(\"Length may not be negative.\");\n        }\n    }\n\n    @Override\n    public int readInt() throws IOException {\n        if (this.position >= 0 && this.position < this.end - 3) {\n            @SuppressWarnings(\"restriction\")\n            int value = UNSAFE.getInt(this.buffer, BASE_OFFSET + this.position);\n            if (LITTLE_ENDIAN) {\n                value = Integer.reverseBytes(value);\n            }\n\n            this.position += 4;\n            return value;\n        } else {\n            throw new EOFException();\n        }\n    }","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/apache/flink/blob/2f3c205e9266cb30240eb7f4fdab15cad629a70f/flink-core/src/main/java/org/apache/flink/core/memory/DataInputDeserializer.java#L160-L196","documentation":"Thrown by DataInputDeserializer.readFully(byte[], int off, int len) when len is negative. readFully is part of the java.io.DataInput contract; Flink rejects a negative length up front rather than passing it to System.arraycopy, which would otherwise throw a less informative ArrayIndexOutOfBoundsException.","triggerScenarios":"Calling readFully(b, off, len) (or the single-arg readFully(b) won't hit this since it passes b.length) with a negative len argument.","commonSituations":"len derived from a deserialized size field that was corrupted to a negative value; passing a default -1 sentinel; arithmetic underflow when subtracting a consumed count from a remaining total.","solutions":["Guard len>=0 before invoking readFully; reject or treat as zero bytes.","Prefer the readFully(byte[]) overload when reading into the whole array.","If len comes from the stream, validate/compare against available() first."],"exampleFix":"// before\ndeserializer.readFully(dst, off, remaining); // remaining may be < 0\n\n// after\nif (remaining > 0) {\n    deserializer.readFully(dst, off, remaining);\n} else if (remaining == 0) {\n    // nothing to read\n}","handlingStrategy":"validation","validationCode":"if (len < 0) {\n    throw new IllegalArgumentException(\"readFully len must be >= 0, got \" + len);\n}\ndeserializer.readFully(dst, off, len);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate length arguments sourced from streams before passing to readFully.","Use readFully(byte[]) when reading into the whole destination array.","Treat a negative computed length as a data-corruption signal, not a default."],"tags":["serialization","bounds-check","deserialization","validation"],"backgroundTag":null,"analyzedSha":"2f3c205e9266cb30240eb7f4fdab15cad629a70f","analyzedAt":"2026-08-14T08:48:24.518Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}