{"record":{"id":"dc3d7522278203a2","repo":"TooTallNate/Java-WebSocket","slug":"1002","errorCode":"1002","errorMessage":"Negative count","messagePattern":"Negative count","errorType":"exception","errorClass":"InvalidDataException","httpStatus":null,"severity":"error","filePath":"src/main/java/org/java_websocket/drafts/Draft.java","lineNumber":324,"sourceCode":"  public abstract CloseHandshakeType getCloseHandshakeType();\n\n  /**\n   * Drafts must only be by one websocket at all. To prevent drafts to be used more than once the\n   * Websocket implementation should call this method in order to create a new usable version of a\n   * given draft instance.<br> The copy can be safely used in conjunction with a new websocket\n   * connection.\n   *\n   * @return a copy of the draft\n   */\n  public abstract Draft copyInstance();\n\n  public Handshakedata translateHandshake(ByteBuffer buf) throws InvalidHandshakeException {\n    return translateHandshakeHttp(buf, role);\n  }\n\n  public int checkAlloc(int bytecount) throws InvalidDataException {\n    if (bytecount < 0) {\n      throw new InvalidDataException(CloseFrame.PROTOCOL_ERROR, \"Negative count\");\n    }\n    return bytecount;\n  }\n\n  int readVersion(Handshakedata handshakedata) {\n    String vers = handshakedata.getFieldValue(\"Sec-WebSocket-Version\");\n    if (vers.length() > 0) {\n      int v;\n      try {\n        v = Integer.parseInt(vers.trim());\n        return v;\n      } catch (NumberFormatException e) {\n        return -1;\n      }\n    }\n    return -1;\n  }\n","sourceCodeStart":306,"sourceCodeEnd":342,"githubUrl":"https://github.com/TooTallNate/Java-WebSocket/blob/afeacbf8c0f6f6a761c9d9daed8c813dd3b8ed7d/src/main/java/org/java_websocket/drafts/Draft.java#L306-L342","documentation":"checkAlloc validates a byte count used to size buffers/reads during frame parsing. A negative count would allocate a negative-size buffer, so Draft throws InvalidDataException with close code 1002 (protocol error), meaning the remote peer sent a malformed frame length that made the computed size negative.","triggerScenarios":"A peer sends a frame whose decoded length field results in a negative byte count, typically a malformed or malicious frame; also reachable from caller code passing negative sizes into draft parsing paths.","commonSituations":"Connecting to a non-conformant or corrupted WebSocket peer, packet corruption, proxies truncating/altering frames, fuzzed clients hitting your server.","solutions":["Identify the peer producing malformed frames (log the remote address) and fix or block it","Ensure intermediate proxies/devices do not corrupt TCP streams","Upgrade java-websocket; newer versions handle malformed lengths more robustly","The connection will be closed with code 1002 — treat this as a peer protocol violation and reconnect cleanly"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// server side: reject obviously malformed frames before they reach draft parsing\nif (payloadLength < 0 || payloadLength > (1L << 63) - 1)\n  throw new InvalidDataException(CloseFrame.PROTOCOL_ERROR, \"bad length\");","typeGuard":null,"tryCatchPattern":"webSocket.setWebSocketFactory(...);\n// at connection level:\nonError(WebSocket conn, Exception ex) {\n  if (ex instanceof InvalidDataException && ((InvalidDataException) ex).getCloseCode() == 1002) {\n    logger.warn(\"Peer sent malformed frame (protocol error), closing: {}\", conn.getRemoteSocketAddress());\n  }\n}","preventionTips":["Treat 1002 closes as peer protocol violations, not your bug","Log remote addresses of peers causing repeated 1002s and rate-limit/block them","Keep java-websocket updated for hardened frame parsing","Ensure intermediaries do not truncate or rewrite TCP payloads"],"tags":["websocket","protocol-error","frames"],"backgroundTag":"schema-validation-failed","analyzedSha":"afeacbf8c0f6f6a761c9d9daed8c813dd3b8ed7d","analyzedAt":"2026-09-09T14:39:47.546Z","contentChangedAt":"2026-09-09T14:39:47.546Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}