{"record":{"id":"fa47754ab5aa440e","repo":"gchq/CyberChef","slug":"invalid-huffman-code-length-while-parsing-deflate","errorCode":null,"errorMessage":"Invalid Huffman Code length while parsing DEFLATE block at pos ${stream.position}: ${codeLength}","messagePattern":"Invalid Huffman Code length while parsing DEFLATE block at pos (.+?): (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/core/lib/FileSignatures.mjs","lineNumber":4001,"sourceCode":"\n\n/**\n * Reads the next Huffman code from the stream, given the relevant code table\n *\n * @param {Stream} stream\n * @param {Uint32Array} table\n * @returns {number}\n */\nfunction readHuffmanCode(stream, table) {\n    const [codeTable, maxCodeLength] = table;\n\n    // Read max length\n    const bitsBuf = stream.readBits(maxCodeLength, \"le\");\n    const codeWithLength = codeTable[bitsBuf & ((1 << maxCodeLength) - 1)];\n    const codeLength = codeWithLength >>> 16;\n\n    if (codeLength > maxCodeLength) {\n        throw new Error(`Invalid Huffman Code length while parsing DEFLATE block at pos ${stream.position}: ${codeLength}`);\n    }\n\n    stream.moveBackwardsByBits(maxCodeLength - codeLength);\n\n    return codeWithLength & 0xffff;\n}\n\n\n/**\n * EVTX extractor.\n *\n * @param {Uint8Array} bytes\n * @param {Number} offset\n * @returns {Uint8Array}\n */\nexport function extractEVTX(bytes, offset) {\n    const stream = new Stream(bytes.slice(offset));\n","sourceCodeStart":3983,"sourceCodeEnd":4019,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/lib/FileSignatures.mjs#L3983-L4019","documentation":"Thrown by readHuffmanCode after indexing the fast-lookup table. It reads maxCodeLength bits, looks up an entry, then unpacks the stored code length from the high 16 bits. A well-formed entry's length must be <= maxCodeLength; a larger value means the table index resolved to an invalid/empty slot, indicating a malformed Huffman table or bit misalignment. Plain Error, not OperationError.","triggerScenarios":"A corrupt or wrongly-built Huffman table where the fast-lookup slot for the read bits contains a sentinel/invalid length; bit drift from an earlier malformed block; non-DEFLATE data reaching the Huffman reader.","commonSituations":"Tampered compressed stream; truncated dynamic-Huffman header; container offset error feeding partial bytes; crafted file exploiting parser assumptions.","solutions":["Validate the compressed stream with a reference inflate before relying on this parser.","Check the upstream table construction (buildHuffmanTable) inputs for the dynamic block.","Re-acquire the source file if integrity cannot be confirmed."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  extractDeflate(bytes, offset);\n} catch (err) {\n  if (/Invalid Huffman Code length/.test(err.message)) {\n    // malformed Huffman table; re-acquire source\n  } else throw err;\n}","preventionTips":["Validate the compressed stream with a reference inflate before relying on this parser.","Inspect buildHuffmanTable inputs for dynamic blocks if you control the caller.","Re-acquire the source when integrity is in doubt."],"tags":["deflate","huffman","parsing","corruption","file-signatures"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}