gchq/CyberChef · error · Error

Invalid Huffman Code length while parsing DEFLATE block at p

Error message

Invalid Huffman Code length while parsing DEFLATE block at pos ${stream.position}: ${codeLength}

What it means

Thrown by readHuffmanCode after indexing the fast-lookup table. It reads maxCodeLength bits, looks up an entry, then unpacks the stored code length from the high 16 bits. A well-formed entry's length must be <= maxCodeLength; a larger value means the table index resolved to an invalid/empty slot, indicating a malformed Huffman table or bit misalignment. Plain Error, not OperationError.

Source

Thrown at src/core/lib/FileSignatures.mjs:4001

/**
 * Reads the next Huffman code from the stream, given the relevant code table
 *
 * @param {Stream} stream
 * @param {Uint32Array} table
 * @returns {number}
 */
function readHuffmanCode(stream, table) {
    const [codeTable, maxCodeLength] = table;

    // Read max length
    const bitsBuf = stream.readBits(maxCodeLength, "le");
    const codeWithLength = codeTable[bitsBuf & ((1 << maxCodeLength) - 1)];
    const codeLength = codeWithLength >>> 16;

    if (codeLength > maxCodeLength) {
        throw new Error(`Invalid Huffman Code length while parsing DEFLATE block at pos ${stream.position}: ${codeLength}`);
    }

    stream.moveBackwardsByBits(maxCodeLength - codeLength);

    return codeWithLength & 0xffff;
}


/**
 * EVTX extractor.
 *
 * @param {Uint8Array} bytes
 * @param {Number} offset
 * @returns {Uint8Array}
 */
export function extractEVTX(bytes, offset) {
    const stream = new Stream(bytes.slice(offset));

View on GitHub (pinned to 4290ea7539)

Solutions

1. Validate the compressed stream with a reference inflate before relying on this parser.
2. Check the upstream table construction (buildHuffmanTable) inputs for the dynamic block.
3. Re-acquire the source file if integrity cannot be confirmed.

try {
  extractDeflate(bytes, offset);
} catch (err) {
  if (/Invalid Huffman Code length/.test(err.message)) {
    // malformed Huffman table; re-acquire source
  } else throw err;
}

When it happens

Trigger: A corrupt or wrongly-built Huffman table where the fast-lookup slot for the read bits contains a sentinel/invalid length; bit drift from an earlier malformed block; non-DEFLATE data reaching the Huffman reader.

Common situations: Tampered compressed stream; truncated dynamic-Huffman header; container offset error feeding partial bytes; crafted file exploiting parser assumptions.

Related errors

• Invalid block type while parsing DEFLATE stream at pos ${str
• Caught in probable infinite loop while parsing Huffman Block
• Invalid marker while parsing JPEG at pos ${stream.position}:
• Unable to parse JPEG successfully
• Invalid recipe

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/fa47754ab5aa440e. Report an issue: GitHub.