{"record":{"id":"c8da7cd93f1596e4","repo":"MuntashirAkon/AppManager","slug":"invalid-iv-length-iv-len","errorCode":null,"errorMessage":"Invalid IV length ${iv_len}","messagePattern":"Invalid IV length (.+?)","errorType":"exception","errorClass":"InvalidAlgorithmParameterException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/io/github/muntashirakon/AppManager/crypto/ks/CompatUtil.java","lineNumber":248,"sourceCode":"        return new AesEncryptedData(iv, encryptedData);\n    }\n\n    /**\n     * Decrypt given data.\n     *\n     * @param context       The context holding the application shared preferences\n     * @param encryptedData Data to be decrypted\n     * @return Decrypted data.\n     */\n    @NonNull\n    public static byte[] decryptData(@NonNull Context context, @NonNull byte[] encryptedData)\n            throws NoSuchPaddingException, NoSuchAlgorithmException, CertificateException,\n            InvalidKeyException, KeyStoreException, UnrecoverableKeyException, IllegalBlockSizeException,\n            NoSuchProviderException, InvalidAlgorithmParameterException, IOException, ShortBufferException, BadPaddingException {\n        ByteBuffer encryptedBuffer = ByteBuffer.wrap(encryptedData);\n        int iv_len = encryptedBuffer.get();\n        if (iv_len != AES_GCM_IV_LENGTH) {\n            throw new InvalidAlgorithmParameterException(\"Invalid IV length \" + iv_len);\n        }\n\n        byte[] iv = new byte[AES_GCM_IV_LENGTH];\n        encryptedBuffer.get(iv);\n\n        Cipher cipher = Cipher.getInstance(AES_GCM_CIPHER_TYPE);\n\n        SecretKeyAndVersion keyAndVersion = getAesGcmLocalProtectionKey(context);\n\n        AlgorithmParameterSpec spec;\n\n        if (keyAndVersion.getAndroidVersionWhenTheKeyHasBeenGenerated() >= Build.VERSION_CODES.M) {\n            spec = new GCMParameterSpec(AES_GCM_KEY_SIZE_IN_BITS, iv);\n        } else {\n            spec = new IvParameterSpec(iv);\n        }\n\n        cipher.init(Cipher.DECRYPT_MODE, keyAndVersion.getSecretKey(), spec);","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/java/io/github/muntashirakon/AppManager/crypto/ks/CompatUtil.java#L230-L266","documentation":"decryptData reads a one-byte IV length prefix from the encrypted blob and validates it against AES_GCM_IV_LENGTH before reading the IV and decrypting. A mismatched prefix means the blob was not produced by this format (or is corrupted), so it throws InvalidAlgorithmParameterException rather than producing garbage plaintext.","triggerScenarios":"Decrypting a byte array whose first byte is not AES_GCM_IV_LENGTH — data written by a different crypto format/version, truncated files, or blobs missing the length-prefix header.","commonSituations":"Reading files encrypted by older app versions or other tools; truncated/corrupted storage; passing ciphertext that lacks the IV-prefix framing.","solutions":["Verify the ciphertext was produced by encryptData with the same IV-prefix format and app version","Re-encrypt the data with the current library format","Add format/version detection before calling decryptData"],"exampleFix":"// before\nint iv_len = encryptedBuffer.get();\nif (iv_len != AES_GCM_IV_LENGTH) {\n    throw new InvalidAlgorithmParameterException(\"Invalid IV length \" + iv_len);\n}\n// after\nif (encryptedBuffer.remaining() < 1) {\n    throw new InvalidAlgorithmParameterException(\"Encrypted data too short\");\n}\nint iv_len = encryptedBuffer.get();\nif (iv_len != AES_GCM_IV_LENGTH) {\n    throw new InvalidAlgorithmParameterException(\"Invalid IV length \" + iv_len + \"; not in expected format\");\n}","handlingStrategy":"validation","validationCode":"if (encryptedData == null || encryptedData.length < 1 + AES_GCM_IV_LENGTH) {\n    throw new IllegalArgumentException(\"Blob too short to contain IV prefix\");\n}\nif (encryptedData[0] != AES_GCM_IV_LENGTH) {\n    throw new IllegalArgumentException(\"Unrecognized ciphertext format\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return CompatUtil.decryptData(encryptedData, key);\n} catch (InvalidAlgorithmParameterException | BadPaddingException e) {\n    // not in expected format or wrong key; surface as data-format error\n    throw new DataFormatException(\"Ciphertext not produced by this app\", e);\n}","preventionTips":["Always round-trip data through the same encrypt/decrypt pair","Version-tag or magic-prefix encrypted blobs","Guard against truncated files before decrypting"],"tags":["crypto","aes-gcm","iv","data-format"],"backgroundTag":"invalid-argument-format","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}