{"record":{"id":"e1cdadeb1f8fa4c2","repo":"hibernate/hibernate-orm","slug":"the-inputstream-must-not-be-null","errorCode":null,"errorMessage":"The InputStream must not be null","messagePattern":"The InputStream must not be null","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hibernate-core/src/main/java/org/hibernate/internal/util/SerializationHelper.java","lineNumber":195,"sourceCode":"\t * @param inputStream the serialized object input stream, must not be null\n\t * @param loader The classloader to use\n\t *\n\t * @return the deserialized object\n\t *\n\t * @throws IllegalArgumentException if <code>inputStream</code> is <code>null</code>\n\t * @throws SerializationException (runtime) if the serialization fails\n\t */\n\tpublic static Object deserialize(InputStream inputStream, ClassLoader loader) throws SerializationException {\n\t\treturn doDeserialize( inputStream, loader, defaultClassLoader(), hibernateClassLoader() );\n\t}\n\n\tpublic static <T> T doDeserialize(\n\t\t\tInputStream inputStream,\n\t\t\tClassLoader loader,\n\t\t\tClassLoader fallbackLoader1,\n\t\t\tClassLoader fallbackLoader2) throws SerializationException {\n\t\tif ( inputStream == null ) {\n\t\t\tthrow new IllegalArgumentException( \"The InputStream must not be null\" );\n\t\t}\n\n\t\tCORE_LOGGER.trace( \"Starting deserialization of object\" );\n\n\t\ttry ( var in = new CustomObjectInputStream( inputStream, loader, fallbackLoader1, fallbackLoader2 ) ) {\n\t\t\t//noinspection unchecked\n\t\t\treturn (T) in.readObject();\n\t\t}\n\t\tcatch (ClassNotFoundException | IOException e) {\n\t\t\tthrow new SerializationException( \"could not deserialize\", e );\n\t\t}\n\t}\n\n\t/**\n\t * Deserializes an object from an array of bytes using the\n\t * Thread Context ClassLoader (TCCL). If there is no TCCL set,\n\t * the classloader of the calling class is used.\n\t * <p>","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/hibernate/hibernate-orm/blob/fad1729dce015f908198d57a8d80274a30f905a5/hibernate-core/src/main/java/org/hibernate/internal/util/SerializationHelper.java#L177-L213","documentation":"SerializationHelper.doDeserialize — the body behind every deserialize overload — requires a non-null InputStream and fails fast with IllegalArgumentException otherwise, before any classloader resolution or stream-header reading happens. Like its serialize sibling, this is a deliberate argument-contract guard.","triggerScenarios":"Calling deserialize(null, loader) or doDeserialize(null, ...), usually because stream acquisition returned null or the byte-to-stream conversion step was skipped.","commonSituations":"Resource lookups returning null (blob not found, connection closed) passed straight through; test code with placeholder arguments; refactors moving stream opening into a conditional branch.","solutions":["Ensure a real InputStream is supplied (e.g., new ByteArrayInputStream(bytes)) before calling deserialize.","Null-check the stream at your own boundary and throw a contextual error naming the resource that failed to open."],"exampleFix":"// before\nInputStream in = openBlobStream(id); // returns null when blob missing\nObject o = SerializationHelper.deserialize(in, loader); // IllegalArgumentException\n\n// after\nInputStream in = openBlobStream(id);\nif (in == null) throw new IllegalStateException(\"no blob for id \" + id);\nObject o = SerializationHelper.deserialize(in, loader);","handlingStrategy":"validation","validationCode":"if (inputStream == null) {\n    throw new IllegalStateException(\"no serialized payload available\");\n}\nObject o = SerializationHelper.deserialize(inputStream, loader);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Null-check streams obtained from resource lookups before use.","Model 'resource absent' as an explicit branch, never as a null pass-through."],"tags":["hibernate","serialization","null-check","argument-validation"],"backgroundTag":"null-argument-contract-violation","analyzedSha":"fad1729dce015f908198d57a8d80274a30f905a5","analyzedAt":"2026-08-22T04:13:57.527Z","schemaVersion":2},"datasetVersion":"2026-08-22T09:17:25.309Z"}