t8y2/dbx · error

length %d exceeds limit

Error message

length %d exceeds limit

What it means

This error is returned by the Hadoop delegation token byte-array reader when a field's length prefix exceeds the 64 MiB safety limit. The library caps parsed token fields to prevent unbounded memory allocation from corrupt or hostile input. It indicates the token is not a valid Hadoop delegation token or is badly misaligned.

Source

Thrown at agents/drivers/argo-go/config.go:807

	if _, err := readHadoopByteArray(reader); err != nil {
		return nil, nil, fmt.Errorf("service: %w", err)
	}
	if reader.Len() != 0 {
		return nil, nil, errors.New("token contains trailing data")
	}
	return identifier, password, nil
}

func readHadoopByteArray(reader io.ByteReader) ([]byte, error) {
	length, err := readHadoopVInt(reader)
	if err != nil {
		return nil, err
	}
	if length < 0 {
		return nil, fmt.Errorf("negative length %d", length)
	}
	if length > 64*1024*1024 {
		return nil, fmt.Errorf("length %d exceeds limit", length)
	}
	value := make([]byte, int(length))
	byteReader, ok := reader.(io.Reader)
	if !ok {
		return nil, errors.New("reader cannot read token payload")
	}
	if _, err := io.ReadFull(byteReader, value); err != nil {
		return nil, err
	}
	return value, nil
}

func readHadoopVInt(reader io.ByteReader) (int64, error) {
	firstByte, err := reader.ReadByte()
	if err != nil {
		return 0, err
	}
	first := int8(firstByte)

View on GitHub (pinned to c0390bff16)

Solutions

  1. Confirm the delegationToken is a real Hadoop delegation token issued by Hive
  2. Regenerate the token from the server
  3. Do not pass other credential types (JWTs, passwords) in the delegationToken field
  4. Base64-decode the token locally and sanity-check its size before use

Example fix

// before
cfg.DelegationToken = myJWT
// after
cfg.DelegationToken = hiveDelegationToken
Defensive patterns

Strategy: validation

Validate before calling

func tokenFieldLengthsSane(token string) error {
	decoded, err := base64.StdEncoding.DecodeString(token)
	if err != nil { return err }
	const maxField = 64 * 1024 * 1024
	_ = maxField // driver rejects any field length above 64MiB
	if len(decoded) > 64*1024*1024 {
		return errors.New("token blob implausibly large — wrong credential type")
	}
	return nil
}

Try / catch

if err := applyToken(cfg, token); err != nil && strings.Contains(err.Error(), "exceeds limit") {
	return fmt.Errorf("delegationToken is not a valid Hadoop token (field too large): %w", err)
}

Prevention

When it happens

Trigger: Decoding a token whose VInt length decodes to a value > 67108864 bytes — effectively only from random/garbage input or a non-token blob.

Common situations: Passing a large arbitrary string (e.g. a JWT or password) as a delegation token; corrupted base64 that misaligns the length parse.

Related errors


AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/708afce6175b416b. Report an issue: GitHub.