paragonie/random_compat · error · Error

Length must be greater than 0

Error message

Length must be greater than 0

What it means

random_bytes() is specified to return cryptographically secure random bytes for a requested length; a length below 1 is meaningless. The library explicitly throws Error when $bytes < 1, matching native PHP 7 behavior where a non-positive length raises ValueError/TypeError. It exists to fail fast rather than return an empty, insecure string.

Solutions

1. Guard the length before calling: if ($len < 1) { throw new InvalidArgumentException('length must be >= 1'); }
2. Fix the source of the zero/negative value (config default, arithmetic, subtraction).
3. Return early or skip generation when the requested size is legitimately zero.
4. For variable lengths, clamp: $len = max(1, $len); if the domain guarantees at least 1 byte is needed.

Example fix

// before
$key = random_bytes($config['key_length']);
// after
$len = (int) ($config['key_length'] ?? 32);
if ($len < 1) {
    throw new InvalidArgumentException('key_length must be >= 1');
}
$key = random_bytes($len);

if (!is_int($len) || $len < 1) {
    throw new InvalidArgumentException('length must be >= 1');
}
$bytes = random_bytes($len);

function isPositiveInt($v) {
    return is_int($v) && $v >= 1;
}

try {
    $bytes = random_bytes($len);
} catch (Error $e) {
    if ($e->getMessage() === 'Length must be greater than 0') {
        throw new InvalidArgumentException('key length must be positive', 0, $e);
    }
    throw $e;
}

When it happens

Trigger: Calling random_bytes(0), random_bytes(-5), or any computed length that evaluates to <= 0 (e.g. subtracting from a counter, an empty/zero config value, intval of '0').

Common situations: A config option for token/key length defaults to 0 or is unset; loop code that computes remaining bytes as 0 and still calls random_bytes; users migrating code that previously tolerated '' from custom RNG helpers.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• Length must be greater than 0
• Length must be greater than 0
• Minimum value must be less than or equal to the maximum…
• random_bytes(): $bytes must be an integer
• RandomCompat_strlen() expects a string

AI-assisted analysis of paragonie/random_compat@b5d188cc9d (2026-09-13). Data as JSON: /api/errors/d05b5a6c8847724e. Report an issue: GitHub.

Appendix: source

Thrown at lib/random_bytes_com_dotnet.php:53

     * @param int $bytes
     *
     * @throws Exception
     *
     * @return string
     */
    function random_bytes($bytes)
    {
        try {
            /** @var int $bytes */
            $bytes = RandomCompat_intval($bytes);
        } catch (TypeError $ex) {
            throw new TypeError(
                'random_bytes(): $bytes must be an integer'
            );
        }

        if ($bytes < 1) {
            throw new Error(
                'Length must be greater than 0'
            );
        }

        /** @var string $buf */
        $buf = '';
        if (!class_exists('COM')) {
            throw new Error(
                'COM does not exist'
            );
        }
        /** @var COM $util */
        $util = new COM('CAPICOM.Utilities.1');
        $execCount = 0;

        /**
         * Let's not let it loop forever. If we run N times and fail to
         * get N bytes of random data, then CAPICOM has failed us.

View on GitHub (pinned to b5d188cc9d)