elastic/elasticsearch · error · IOException

Invalid DER: length larger than max-int

Error message

Invalid DER: length larger than max-int

What it means

Thrown by DerParser.getLength() after BigInteger(1, bytes).intValue() returns a negative number. intValue() truncates a BigInteger to 32 bits; if the real value exceeds Integer.MAX_VALUE the truncated int can be negative, signalling a length that cannot be represented as a Java int.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java:143

        int i = derInputStream.read();
        if (i == -1) throw new IOException("Invalid DER: length missing");

        // A single byte short length
        if ((i & ~0x7F) == 0) return i;

        int num = i & 0x7F;

        // We can't handle length longer than 4 bytes
        if (i >= 0xFF || num > 4) throw new IOException("Invalid DER: length field too big (" + i + ")"); //$NON-NLS-2$

        byte[] bytes = new byte[num];
        int n = derInputStream.read(bytes);
        if (n < num) throw new IOException("Invalid DER: length too short");

        int len = new BigInteger(1, bytes).intValue();
        if (len < 0) {
            throw new IOException("Invalid DER: length larger than max-int");
        }

        return len;
    }

    /**
     * An ASN.1 TLV. The object is not parsed. It can
     * only handle integers.
     *
     * @author zhang
     */
    public static class Asn1Object {

        protected final int type;
        protected final int length;
        protected final byte[] value;
        protected final int tag;

View on GitHub (pinned to db6a809a66)

Solutions

1. Treat this as corruption: re-export the key from the source.
2. Hex-dump the region and confirm length octets are within expected ranges (key DER is typically < 4 KiB).
3. If you are programmatically building DER, ensure length encoding never exceeds int range — split large payloads if needed.
4. Run `openssl asn1parse -inform DER -in key.der` to locate the malformed element.

Example fix

// before: corrupted length bytes (0x84 0x80 0x00 0x00 0x00 = 2 GiB)
byte[] bad = hexToBytes("308480000000");
new DerParser(bad).readAsn1Object();

// after: re-export the key cleanly
// openssl pkey -in corrupted.pem -out clean.pem
byte[] good = Files.readAllBytes(Path.of("clean.der"));
new DerParser(good).readAsn1Object();

private static void requireIntRangeLength(byte[] der, int idx, int num) {
    long len = 0;
    for (int i = 0; i < num; i++) len = (len << 8) | (der[idx + i] & 0xFF);
    if (len > Integer.MAX_VALUE) {
        throw new IllegalArgumentException("declared length " + len + " exceeds Integer.MAX_VALUE; likely corruption");
    }
}

When it happens

Trigger: Long-form length bytes decode to a BigInteger larger than 2^31-1. The value() check `len < 0` catches the truncation. Encountered on DER whose length field encodes a multi-gigabyte object — almost always corruption, since real key material is far smaller.

Common situations: Corrupted length octets, random bytes presented as DER, or a malformed file where the parser is misaligned (e.g. wrong byte interpreted as a length because earlier elements were skipped).

Related errors

• Invalid DER: size of ASN.1 object to be parsed appears to be
• Invalid DER: stream too short, missing value. Could only rea
• Invalid DER: length missing
• Invalid DER: length field too big ({})
• Invalid DER: length too short

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/9da98b35bec816c1. Report an issue: GitHub.