t8y2/dbx · error

negative length %d

Error message

negative length %d

What it means

This error means a length-prefixed field inside the delegation token declared a negative length when decoded as a Hadoop VInt. The parser rejects negative lengths because byte arrays cannot have negative size, indicating a corrupt or non-Hadoop-format token. It is an internal guard in readHadoopByteArray.

Source

Thrown at agents/drivers/hive-go/config.go:807

	if _, err := readHadoopByteArray(reader); err != nil {
		return nil, nil, fmt.Errorf("kind: %w", err)
	}
	if _, err := readHadoopByteArray(reader); err != nil {
		return nil, nil, fmt.Errorf("service: %w", err)
	}
	if reader.Len() != 0 {
		return nil, nil, errors.New("token contains trailing data")
	}
	return identifier, password, nil
}

func readHadoopByteArray(reader io.ByteReader) ([]byte, error) {
	length, err := readHadoopVInt(reader)
	if err != nil {
		return nil, err
	}
	if length < 0 {
		return nil, fmt.Errorf("negative length %d", length)
	}
	if length > 64*1024*1024 {
		return nil, fmt.Errorf("length %d exceeds limit", length)
	}
	value := make([]byte, int(length))
	byteReader, ok := reader.(io.Reader)
	if !ok {
		return nil, errors.New("reader cannot read token payload")
	}
	if _, err := io.ReadFull(byteReader, value); err != nil {
		return nil, err
	}
	return value, nil
}

func readHadoopVInt(reader io.ByteReader) (int64, error) {
	firstByte, err := reader.ReadByte()
	if err != nil {

View on GitHub (pinned to c0390bff16)

Solutions

1. Confirm the credential is a genuine Hadoop Hive delegation token, not another token type
2. Re-fetch the token from the server's getDelegationToken API
3. Validate base64 decoding and byte integrity of the token

Example fix

// before
token := jwtFromSSO() // wrong type
cfg.SetDelegationToken(token)
// after
token := hs2DelegationTokenFromServer()
cfg.SetDelegationToken(token)

func tokenLooksSane(token string) bool {
	raw, err := base64.StdEncoding.DecodeString(token)
	return err == nil && len(raw) > 0 && raw[0] >= 0
}

if err != nil && strings.Contains(err.Error(), "negative length") {
	return fmt.Errorf("credential is not a Hadoop delegation token: %w", err)
}

When it happens

Trigger: A delegation token whose VInt length bytes decode to a negative number, typically from random/invalid binary data or a wrong encoding passed as a token.

Common situations: Passing an arbitrary base64 string (JWT, API key) where a Hadoop delegation token is expected; bit-flipped or corrupted stored token.

Related errors

• token identifier and password must be non-empty
• token contains trailing data
• identifier: %w
• password: %w
• kind: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/834dad3fece14838. Report an issue: GitHub.