{"record":{"id":"f823aa52aa369816","repo":"apache/flink","slug":"invalid-bounds","errorCode":null,"errorMessage":"Invalid bounds.","messagePattern":"Invalid bounds\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"flink-core/src/main/java/org/apache/flink/core/memory/DataInputDeserializer.java","lineNumber":88,"sourceCode":"            this.end = this.position + buffer.remaining();\n        } else if (buffer.isDirect() || buffer.isReadOnly()) {\n            // TODO: FLINK-8585 handle readonly and other non array based buffers more efficiently\n            // without data copy\n            this.buffer = new byte[buffer.remaining()];\n            this.position = 0;\n            this.end = this.buffer.length;\n\n            buffer.get(this.buffer);\n        } else {\n            throw new IllegalArgumentException(\n                    \"The given buffer is neither an array-backed heap ByteBuffer, nor a direct ByteBuffer.\");\n        }\n    }\n\n    public void setBuffer(@Nonnull byte[] buffer, int start, int len) {\n\n        if (start < 0 || len < 0 || start + len > buffer.length) {\n            throw new IllegalArgumentException(\"Invalid bounds.\");\n        }\n\n        setBufferInternal(buffer, start, len);\n    }\n\n    public void setBuffer(@Nonnull byte[] buffer) {\n        setBufferInternal(buffer, 0, buffer.length);\n    }\n\n    private void setBufferInternal(@Nonnull byte[] buffer, int start, int len) {\n        this.buffer = buffer;\n        this.position = start;\n        this.end = start + len;\n    }\n\n    public void releaseArrays() {\n        this.buffer = null;\n    }","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/apache/flink/blob/2f3c205e9266cb30240eb7f4fdab15cad629a70f/flink-core/src/main/java/org/apache/flink/core/memory/DataInputDeserializer.java#L70-L106","documentation":"Thrown by DataInputDeserializer.setBuffer(byte[], int, int) (and the matching constructor) when start is negative, len is negative, or start+len exceeds buffer.length. It clamps the deserialization window so all subsequent reads stay inside the backing byte array.","triggerScenarios":"Calling setBuffer(buffer, start, len) or new DataInputDeserializer(buffer, start, len) with start<0, with len<0, or with start+len greater than buffer.length.","commonSituations":"Off-by-one when computing length from a position (e.g. passing end instead of end-start); reusing a sub-array with stale offset math; slicing a buffer region with an end index that overshoots the array.","solutions":["Validate start>=0, len>=0, and start+len<=buffer.length before calling setBuffer.","Use setBuffer(byte[]) (no offsets) when you intend to read the whole array.","Clamp the length: len = Math.min(requestedLen, buffer.length - start)."],"exampleFix":"// before\ndeserializer.setBuffer(buf, offset, end); // end overshoots\n\n// after\nint len = Math.min(end - offset, buf.length - offset);\ndeserializer.setBuffer(buf, offset, len >= 0 ? len : 0);","handlingStrategy":"validation","validationCode":"static boolean validBounds(byte[] buffer, int start, int len) {\n    return start >= 0 && len >= 0 && start + len <= buffer.length;\n}\n// if (validBounds(buf, start, len)) deserializer.setBuffer(buf, start, len);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Compute length from indices, not from an end position: len = end - start.","Prefer the no-offset setBuffer(byte[]) overload when reading the whole array.","Clamp len with Math.min(requested, buffer.length - start)."],"tags":["serialization","bounds-check","validation","deserialization"],"backgroundTag":null,"analyzedSha":"2f3c205e9266cb30240eb7f4fdab15cad629a70f","analyzedAt":"2026-08-14T08:48:24.518Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}