{"record":{"id":"c58f23c63100690d","repo":"MuntashirAkon/AppManager","slug":"length-length-must-be-at-least-2","errorCode":null,"errorMessage":"Length ${length} must be at least 2","messagePattern":"Length (.+?) must be at least 2","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/org/apache/commons/compress/archivers/tar/TarUtils.java","lineNumber":106,"sourceCode":"     * (this allows for missing fields).</p>\n     *\n     * <p>To work-around some tar implementations that insert a\n     * leading NUL this method returns 0 if it detects a leading NUL\n     * since Commons Compress 1.4.</p>\n     *\n     * @param buffer The buffer from which to parse.\n     * @param offset The offset into the buffer from which to parse.\n     * @param length The maximum number of bytes to parse - must be at least 2 bytes.\n     * @return The long value of the octal string.\n     * @throws IllegalArgumentException if the trailing space/NUL is missing or if a invalid byte is detected.\n     */\n    public static long parseOctal(final byte[] buffer, final int offset, final int length) {\n        long    result = 0;\n        int     end = offset + length;\n        int     start = offset;\n\n        if (length < 2){\n            throw new IllegalArgumentException(\"Length \"+length+\" must be at least 2\");\n        }\n\n        if (buffer[start] == 0) {\n            return 0L;\n        }\n\n        // Skip leading spaces\n        while (start < end){\n            if (buffer[start] == ' '){\n                start++;\n            } else {\n                break;\n            }\n        }\n\n        // Trim all trailing NULs and spaces.\n        // The ustar and POSIX tar specs require a trailing NUL or\n        // space but some implementations use the extra digit for big","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/java/org/apache/commons/compress/archivers/tar/TarUtils.java#L88-L124","documentation":"TarUtils.parseOctal requires a field of at least 2 bytes because a valid octal field needs at least one digit plus a terminator (space/NUL); shorter slices cannot be valid tar numeric fields. The library throws IllegalArgumentException when handed a length < 2. It indicates a malformed or mis-read tar header offset/length, since every standard tar numeric field is several bytes wide.","triggerScenarios":"Calling TarUtils.parseOctal(buffer, offset, length) with length 0 or 1; corrupt or hand-crafted headers where numeric fields were sliced with wrong lengths (e.g. checksum, size, mtime fields shorter than the 8/12-byte tar spec).","commonSituations":"Parsing a tar file with a manually implemented header reader that uses wrong field offsets; fuzzed/corrupted archives; passing the wrong constants (not TarConstants.SIZELEN/CHKSUMLEN etc.) to parseOctal directly.","solutions":["Fix the length passed to parseOctal to match the tar spec field size (e.g. SIZELEN=12, CHKSUMLEN=8, DEVLEN=8)","Verify the header offset is correct — a misaligned offset makes the field read start/end land wrongly","Use parseOctalOrBinary if the archive may use GNU base-256 encoding; but never with length<2","Validate the buffer slice is a real tar header field before parsing"],"exampleFix":"// before\nlong size = TarUtils.parseOctal(header, 124, 2);\n// after\nlong size = TarUtils.parseOctal(header, TarConstants.SIZE_OFFSET, TarConstants.SIZELEN);","handlingStrategy":"validation","validationCode":"public static long safeParseOctal(byte[] buffer, int offset, int length) {\n    if (buffer == null || length < 2 || offset + length > buffer.length) {\n        throw new IllegalArgumentException(\"Field slice too small: offset=\" + offset + \" length=\" + length);\n    }\n    return TarUtils.parseOctal(buffer, offset, length);\n}","typeGuard":"static boolean validFieldSlice(byte[] buffer, int offset, int length) {\n    return buffer != null && length >= 2 && offset >= 0 && offset + length <= buffer.length;\n}","tryCatchPattern":"try {\n    long value = TarUtils.parseOctal(header, offset, fieldLen);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"Length \")) {\n        throw new MalformedArchiveException(\"Tar numeric field shorter than 2 bytes at offset \" + offset);\n    }\n    throw e;\n}","preventionTips":["Use TarConstants field lengths (SIZELEN, CHKSUMLEN, DEVLEN, etc.) instead of hand-written numbers","Validate header offset alignment before parsing fields","Fuzz-test your tar reader with truncated headers","Consider using Commons Compress's TarArchiveInputStream rather than raw TarUtils"],"tags":["java","tar","octal","argument-length"],"backgroundTag":"argument-out-of-range","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}