{"record":{"id":"c478b198f56e2162","repo":"t8y2/dbx","slug":"length-d-exceeds-limit-c478b1","errorCode":null,"errorMessage":"length %d exceeds limit","messagePattern":"length (.+?) exceeds limit","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":810,"sourceCode":"\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"service: %w\", err)\n\t}\n\tif reader.Len() != 0 {\n\t\treturn nil, nil, errors.New(\"token contains trailing data\")\n\t}\n\treturn identifier, password, nil\n}\n\nfunc readHadoopByteArray(reader io.ByteReader) ([]byte, error) {\n\tlength, err := readHadoopVInt(reader)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif length < 0 {\n\t\treturn nil, fmt.Errorf(\"negative length %d\", length)\n\t}\n\tif length > 64*1024*1024 {\n\t\treturn nil, fmt.Errorf(\"length %d exceeds limit\", length)\n\t}\n\tvalue := make([]byte, int(length))\n\tbyteReader, ok := reader.(io.Reader)\n\tif !ok {\n\t\treturn nil, errors.New(\"reader cannot read token payload\")\n\t}\n\tif _, err := io.ReadFull(byteReader, value); err != nil {\n\t\treturn nil, err\n\t}\n\treturn value, nil\n}\n\nfunc readHadoopVInt(reader io.ByteReader) (int64, error) {\n\tfirstByte, err := reader.ReadByte()\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\tfirst := int8(firstByte)","sourceCodeStart":792,"sourceCodeEnd":828,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L792-L828","documentation":"This error means a field length in the delegation token exceeded the 64 MiB safety limit enforced by readHadoopByteArray. The driver caps parsed token fields to prevent absurd allocations from corrupt or hostile input. A length over 64*1024*1024 bytes means the token is malformed or not a delegation token.","triggerScenarios":"A delegation token whose VInt length prefix decodes to more than 67108864 bytes, usually from decoding an unrelated large binary blob as a token.","commonSituations":"Passing a large certificate, keystore, or other base64 blob in the delegationToken field; corrupted multi-byte VInt inflating the decoded length.","solutions":["Verify only the actual delegation token string is passed to delegationToken/token/password","Re-fetch the token from the Hive server; it should be a few hundred bytes","Check that the token's base64 encoding was not double-encoded, shifting length bytes"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"func tokenSizeReasonable(token string) bool {\n\traw, err := base64.StdEncoding.DecodeString(token)\n\treturn err == nil && len(raw) < 64*1024*1024 && len(raw) > 0\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"exceeds limit\") {\n\treturn fmt.Errorf(\"not a delegation token (too large): %w\", err)\n}","preventionTips":["Check token size is a few hundred bytes; larger blobs are the wrong credential","Avoid double base64-encoding which can shift length bytes","Configure only the token field with the token string"],"tags":["hive","delegation-token","serialization","limit"],"backgroundTag":"delegation-token-decode-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}