microg/GmsCore · error · RuntimeException

CertData to small

Error message

CertData to small

What it means

CertData wraps a certificate byte array and requires at least 25 bytes, since its hashCode is computed over the first 25 bytes. It throws RuntimeException (not a checked exception) when the provided byte array is shorter, indicating the input is not a valid certificate blob for this protocol.

Source

Thrown at play-services-basement/src/main/java/com/google/android/gms/common/internal/CertData.java:34

package com.google.android.gms.common.internal;

import android.os.IBinder;
import android.os.RemoteException;

import androidx.annotation.Nullable;
import com.google.android.gms.dynamic.IObjectWrapper;
import com.google.android.gms.dynamic.ObjectWrapper;

import java.util.Arrays;

public class CertData extends ICertData.Stub {
    private final byte[] bytes;
    private final int hashCode;

    public CertData(byte[] bytes) {
        this.bytes = bytes;
        if (bytes.length < 25) throw new RuntimeException("CertData to small");
        hashCode = Arrays.hashCode(Arrays.copyOfRange(bytes, 0, 25));
    }

    @Override
    public int hashCode() {
        return hashCode;
    }

    @Override
    public boolean equals(Object obj) {
        if (!(obj instanceof ICertData)) return false;
        ICertData cert = (ICertData) obj;
        try {
            if (cert.remoteHashCode() != hashCode()) return false;
            return Arrays.equals(ObjectWrapper.unwrapTyped(cert.getWrappedBytes(), byte[].class), getBytes());
        } catch (RemoteException e) {
            return false;
        }

View on GitHub (pinned to 157c9d86ac)

Solutions

1. Verify the certificate byte array length (>= 25) before constructing CertData
2. Ensure the full signature/certificate bytes are passed, not a truncated or derived value
3. Re-acquire the certificate data from Signature[] / PackageManager if it was corrupted

Example fix

// before
CertData cert = new CertData(sig.get.toByteArray()); // may be truncated
// after
byte[] b = sig.get.toByteArray();
if (b.length < 25) throw new BadCertificateException("cert too small");
CertData cert = new CertData(b);

byte[] b = signature.toByteArray();
if (b != null && b.length >= 25) {
    CertData cert = new CertData(b);
}

try { new CertData(bytes); } catch (RuntimeException e) { /* reject invalid cert blob */ }

When it happens

Trigger: Calling new CertData(bytes) with a byte[] shorter than 25 bytes, e.g. an empty array, truncated certificate, or wrong data passed in.

Common situations: Reading a corrupted or truncated package signature; passing the wrong field (e.g. a hash instead of full cert data) from package info.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• deleteAll was set to true but keys were also provided
• Element in keys cannot be null or empty
• deleteAll=true but keys are provided
• retrieveAll was set to true but other constraint(s) was also
• Element in keys cannot be null or empty

AI-assisted analysis of microg/GmsCore@157c9d86ac (2026-09-06). Data as JSON: /api/errors/3a1d1fe6b273cdbe. Report an issue: GitHub.