iflytek/astron-agent · error · AesException

-40008

-40008

Error message

Illegal buffer after decryption

What it means

After successful AES decryption, decrypt() unpacks the 16-byte random prefix, 4-byte message length, XML body, and receiving appid. Any exception while parsing these bytes (truncated plaintext, wrong padding producing nonsense lengths, charset issues) is wrapped into AesException(-40008, 'IllegalBuffer').

Solutions

1. Most often a symptom of the wrong encodingAesKey — verify it matches the sending app (same root cause as -40007)
2. Ensure the full encrypted POST body is read (use request.getInputStream fully, don't trust partial reads) and the Encrypt field extracted intact
3. Verify the signature (msg_signature) before decrypting to detect tampering
4. Check the stack trace from e.printStackTrace() for ArrayIndexOutOfBounds vs charset errors to distinguish truncation from key issues

Example fix

// before
String encrypt = body.substring(body.indexOf("<Encrypt>") + 9); // fragile slice
// after
Document doc = parseXml(body);
String encrypt = doc.getElementsByTagName("Encrypt").item(0).getTextContent(); // intact ciphertext

try { String xml = crypt.decrypt(encrypt, signature, timestamp, nonce); } catch (AesException e) { if (e.getCode() == -40008) { log.warn("illegal buffer after decrypt for appId {} — verify key and full body read", appId); } throw e; }

When it happens

Trigger: The decrypted plaintext is shorter than 20 bytes or copyOfRange exceeds bounds because the wrong key produced garbage plaintext that fails PKCS7 padding, or the message body was truncated before decryption.

Common situations: A key mismatch that coincidentally decrypts (padding succeeds) but yields malformed bytes, cutting the callback body mid-way (read the full POST body), or a middleman re-encoding the ciphertext.

Related errors

• -40004
• -40006
• -40007
• BOT_NOT_EXISTS
• PARAMS_ERROR

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/0c551d516012a598. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/hub/src/main/java/com/iflytek/astron/console/hub/util/wechat/WXBizMsgCrypt.java:182

            throw new AesException(AesException.DecryptAESError);
        }

        String xmlContent, from_appid;
        try {
            // Remove padding
            byte[] bytes = PKCS7Encoder.decode(original);

            // Separate 16-bit random string, network byte order, and appId
            byte[] networkOrder = Arrays.copyOfRange(bytes, 16, 20);

            int xmlLength = recoverNetworkBytesOrder(networkOrder);

            xmlContent = new String(Arrays.copyOfRange(bytes, 20, 20 + xmlLength), CHARSET);
            from_appid = new String(Arrays.copyOfRange(bytes, 20 + xmlLength, bytes.length),
                    CHARSET);
        } catch (Exception e) {
            e.printStackTrace();
            throw new AesException(AesException.IllegalBuffer);
        }

        // Verify appid
        if (!from_appid.equals(appId)) {
            throw new AesException(AesException.ValidateAppidError);
        }
        return xmlContent;

    }

    /**
     * Verify URL
     *
     * @param msgSignature Signature string
     * @param timeStamp Timestamp
     * @param nonce Random number
     * @param echoStr Random string
     * @return Decrypted echostr

View on GitHub (pinned to 5e758547a8)