microg/GmsCore · error · IllegalArgumentException

length of flags is smaller than LENGTH_MIN_SECURITY_POLICY_F

Error message

length of flags is smaller than LENGTH_MIN_SECURITY_POLICY_FLAGS

What it means

ThreadNetworkCredentials.SecurityPolicy's constructor requires the flags array to be at least LENGTH_MIN_SECURITY_POLICY_FLAGS bytes (1 byte for Thread 1.1, 2 for Thread 1.2+) and throws IllegalArgumentException if shorter. The flags field in the Thread dataset has a specification-defined minimum length that must be honored.

Source

Thrown at play-services-threadnetwork/src/main/java/com/google/android/gms/threadnetwork/ThreadNetworkCredentials.java:178

    /**
     * The class represents Thread Security Policy.
     */
    public static class SecurityPolicy {
        private final int rotationTimeHours;
        private final byte[] flags;

        /**
         * Creates a new {@link SecurityPolicy} object.
         *
         * @param rotationTimeHours the value for Thread key rotation in hours. Must be in range of 0x1-0xffff.
         * @param flags             security policy flags with length of either 1 byte for Thread 1.1 or 2 bytes for Thread 1.2 or higher.
         * @throws IllegalArgumentException if {@code rotationTimeHours} is not in range of 0x1-0xffff or
         *                                  length of flags is smaller than {@link ThreadNetworkCredentials#LENGTH_MIN_SECURITY_POLICY_FLAGS}.
         */
        public SecurityPolicy(int rotationTimeHours, byte[] flags) {
            if (rotationTimeHours < 1 || rotationTimeHours > 0xffff) throw new IllegalArgumentException("rotationTimeHours is not in range of 0x1-0xffff");
            if (flags.length < LENGTH_MIN_SECURITY_POLICY_FLAGS) throw new IllegalArgumentException("length of flags is smaller than LENGTH_MIN_SECURITY_POLICY_FLAGS");
            this.rotationTimeHours = rotationTimeHours;
            this.flags = flags;
        }

        /**
         * Returns 1 byte flags for Thread 1.1 or 2 bytes flags for Thread 1.2.
         */
        public byte[] getFlags() {
            return flags;
        }

        /**
         * Returns the Security Policy Rotation Time in hours.
         */
        public int getRotationTimeHours() {
            return rotationTimeHours;
        }
    }

View on GitHub (pinned to 157c9d86ac)

Solutions

1. Ensure flags is at least LENGTH_MIN_SECURITY_POLICY_FLAGS bytes long before constructing
2. Use a 1-byte array for Thread 1.1 and a 2-byte array for Thread 1.2+ networks
3. Check the array construction — e.g. new byte[]{flagByte} instead of an empty array
4. Read LENGTH_MIN_SECURITY_POLICY_FLAGS from ThreadNetworkCredentials rather than hardcoding

Example fix

// before
SecurityPolicy policy = new SecurityPolicy(672, new byte[0]); // IllegalArgumentException
// after
byte[] flags = new byte[] { (byte) 0xFF }; // 1 byte for Thread 1.1 (2 bytes for 1.2+)
SecurityPolicy policy = new SecurityPolicy(672, flags);

if (flags == null || flags.length < ThreadNetworkCredentials.LENGTH_MIN_SECURITY_POLICY_FLAGS) throw new IllegalArgumentException("flags too short");

boolean isValidFlags(byte[] flags) { return flags != null && flags.length >= 1; }

try {
    SecurityPolicy p = new SecurityPolicy(rotationTimeHours, flags);
} catch (IllegalArgumentException e) {
    // supply a correctly sized flags array
}

When it happens

Trigger: Passing a byte[] flags with length 0 or shorter than LENGTH_MIN_SECURITY_POLICY_FLAGS — e.g. an empty array, a truncated decode, or confusing the flags count with the array length.

Common situations: Building SecurityPolicy before populating flags; hex/base64 decode of flags dropping bytes; passing individual flag values instead of a byte array.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• the id is not of length 16 bytes
• page exceeds range [0, 255].
• rotationTimeHours is not in range of 0x1-0xffff
• deleteAll was set to true but keys were also provided
• Element in keys cannot be null or empty

AI-assisted analysis of microg/GmsCore@157c9d86ac (2026-09-06). Data as JSON: /api/errors/b9dae1a2505cd917. Report an issue: GitHub.