t8y2/dbx · error

negative length %d

Error message

negative length %d

What it means

This error is returned by the Hadoop delegation token byte-array reader when a field's VInt length prefix decodes to a negative number. A negative length is invalid in the token wire format and indicates the token bytes are corrupt or the parser is misaligned. It propagates up wrapped by the identifier/password/kind/service field errors.

Source

Thrown at agents/drivers/argo-go/config.go:804

	if _, err := readHadoopByteArray(reader); err != nil {
		return nil, nil, fmt.Errorf("kind: %w", err)
	}
	if _, err := readHadoopByteArray(reader); err != nil {
		return nil, nil, fmt.Errorf("service: %w", err)
	}
	if reader.Len() != 0 {
		return nil, nil, errors.New("token contains trailing data")
	}
	return identifier, password, nil
}

func readHadoopByteArray(reader io.ByteReader) ([]byte, error) {
	length, err := readHadoopVInt(reader)
	if err != nil {
		return nil, err
	}
	if length < 0 {
		return nil, fmt.Errorf("negative length %d", length)
	}
	if length > 64*1024*1024 {
		return nil, fmt.Errorf("length %d exceeds limit", length)
	}
	value := make([]byte, int(length))
	byteReader, ok := reader.(io.Reader)
	if !ok {
		return nil, errors.New("reader cannot read token payload")
	}
	if _, err := io.ReadFull(byteReader, value); err != nil {
		return nil, err
	}
	return value, nil
}

func readHadoopVInt(reader io.ByteReader) (int64, error) {
	firstByte, err := reader.ReadByte()
	if err != nil {

View on GitHub (pinned to c0390bff16)

Solutions

1. Verify the delegationToken value is the actual base64 Hadoop token issued by the server
2. Regenerate the token from the Hive server
3. Do not pass passwords or other credentials in the delegationToken field
4. Check that no encoding conversion altered the token bytes

Example fix

// before
cfg.DelegationToken = cfg.Password // wrong credential type
// after
cfg.DelegationToken = issuedDelegationToken

func isPlausibleHadoopToken(token string) bool {
	decoded, err := base64.StdEncoding.DecodeString(token)
	if err != nil || len(decoded) < 16 { return false }
	// first VInt should be a small positive length for the identifier
	first := int(decoded[0])
	return first > 0 && first < len(decoded)
}

func looksLikeHadoopToken(v interface{}) bool {
	s, ok := v.(string)
	if !ok { return false }
	return isPlausibleHadoopToken(s)
}

if err := applyToken(cfg, token); err != nil && strings.Contains(err.Error(), "negative length") {
	return fmt.Errorf("delegationToken is not a Hadoop token — check credential type: %w", err)
}

When it happens

Trigger: Decoding a delegation token whose bytes contain a VInt length that decodes negative — typically random/corrupt bytes or reading a non-token blob as a token.

Common situations: Passing an arbitrary password or random string as a delegationToken; token bytes bit-flipped by an encoding conversion (e.g. UTF-16); decoding a foreign token format.

Related errors

• identifier: %w
• password: %w
• kind: %w
• service: %w
• Hive delegation token authentication requires delegationToke

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/1557ae7ea64a38f7. Report an issue: GitHub.