t8y2/dbx · error
length %d exceeds limit
Error message
length %d exceeds limit
What it means
This error is returned by the Hadoop delegation token byte-array reader when a field's length prefix exceeds the 64 MiB safety limit. The library caps parsed token fields to prevent unbounded memory allocation from corrupt or hostile input. It indicates the token is not a valid Hadoop delegation token or is badly misaligned.
Source
Thrown at agents/drivers/argo-go/config.go:807
if _, err := readHadoopByteArray(reader); err != nil {
return nil, nil, fmt.Errorf("service: %w", err)
}
if reader.Len() != 0 {
return nil, nil, errors.New("token contains trailing data")
}
return identifier, password, nil
}
func readHadoopByteArray(reader io.ByteReader) ([]byte, error) {
length, err := readHadoopVInt(reader)
if err != nil {
return nil, err
}
if length < 0 {
return nil, fmt.Errorf("negative length %d", length)
}
if length > 64*1024*1024 {
return nil, fmt.Errorf("length %d exceeds limit", length)
}
value := make([]byte, int(length))
byteReader, ok := reader.(io.Reader)
if !ok {
return nil, errors.New("reader cannot read token payload")
}
if _, err := io.ReadFull(byteReader, value); err != nil {
return nil, err
}
return value, nil
}
func readHadoopVInt(reader io.ByteReader) (int64, error) {
firstByte, err := reader.ReadByte()
if err != nil {
return 0, err
}
first := int8(firstByte)View on GitHub (pinned to c0390bff16)
Solutions
- Confirm the delegationToken is a real Hadoop delegation token issued by Hive
- Regenerate the token from the server
- Do not pass other credential types (JWTs, passwords) in the delegationToken field
- Base64-decode the token locally and sanity-check its size before use
Example fix
// before cfg.DelegationToken = myJWT // after cfg.DelegationToken = hiveDelegationToken
Defensive patterns
Strategy: validation
Validate before calling
func tokenFieldLengthsSane(token string) error {
decoded, err := base64.StdEncoding.DecodeString(token)
if err != nil { return err }
const maxField = 64 * 1024 * 1024
_ = maxField // driver rejects any field length above 64MiB
if len(decoded) > 64*1024*1024 {
return errors.New("token blob implausibly large — wrong credential type")
}
return nil
} Try / catch
if err := applyToken(cfg, token); err != nil && strings.Contains(err.Error(), "exceeds limit") {
return fmt.Errorf("delegationToken is not a valid Hadoop token (field too large): %w", err)
} Prevention
- Sanity-check token size (< a few KB is typical) before passing to the driver
- Keep credential types distinct in your config schema (typed fields, not strings)
- Reject oversized secret values at config load time
- Log token length, never token content, when debugging
When it happens
Trigger: Decoding a token whose VInt length decodes to a value > 67108864 bytes — effectively only from random/garbage input or a non-token blob.
Common situations: Passing a large arbitrary string (e.g. a JWT or password) as a delegation token; corrupted base64 that misaligns the length parse.
Related errors
- Hive delegation token authentication requires delegationToke
- token is empty
- Hive delegation token authentication requires delegationToke
- token is empty
- token identifier and password must be non-empty
AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05).
Data as JSON: /api/errors/708afce6175b416b.
Report an issue: GitHub.