vxcontrol/pentagi · error

file '%s' has invalid size %d

Error message

file '%s' has invalid size %d

What it means

Defensive check: a tar header with a negative Size is structurally invalid (tar sizes are non-negative octal fields), so attempting `make([]byte, tarHeader.Size)` would panic. The function rejects such a stream with this error before allocating. Reaching it means the tar reader produced a malformed header or a corrupted/custom stream was fed in.

Source

Thrown at backend/pkg/tools/terminal.go:409

		if tarHeader.FileInfo().IsDir() {
			continue
		}

		if stats.Mode.IsDir() {
			buffer.WriteString("--------------------------------------------------\n")
			buffer.WriteString(
				fmt.Sprintf("'%s' file content (with size %d bytes) shown below:\n",
					tarHeader.Name, tarHeader.Size,
				),
			)
		}

		const maxReadFileSize int64 = 100 * 1024 * 1024 // 100 MB limit
		if tarHeader.Size > maxReadFileSize {
			return "", fmt.Errorf("file '%s' size %d exceeds maximum allowed size %d", tarHeader.Name, tarHeader.Size, maxReadFileSize)
		}
		if tarHeader.Size < 0 {
			return "", fmt.Errorf("file '%s' has invalid size %d", tarHeader.Name, tarHeader.Size)
		}

		var fileContent = make([]byte, tarHeader.Size)
		_, err = tarReader.Read(fileContent)
		if err != nil && err != io.EOF {
			return "", fmt.Errorf("failed to read file '%s' content: %w", tarHeader.Name, err)
		}
		buffer.Write(fileContent)

		if stats.Mode.IsDir() {
			buffer.WriteString("\n\n")
		}
	}

	return buffer.String(), nil
}

func (t *terminal) WriteFile(ctx context.Context, flowID int64, content string, path string) (string, error) {

View on GitHub (pinned to ea665308ba)

Solutions

1. Treat as data corruption: retry the whole CopyFromContainer read from scratch
2. Verify Docker daemon and client versions match on remote hosts; upgrade mismatched daemons
3. Check transport integrity (TLS, proxies) between client and daemon if using DOCKER_HOST over TCP
4. If it reproduces deterministically on one file, re-create the file inside the container (it may be a sparse/special file the daemon tars oddly)

Example fix

// before
var fileContent = make([]byte, tarHeader.Size)
// after (already guarded in current code)
if tarHeader.Size < 0 {
    return "", fmt.Errorf("file '%s' has invalid size %d", tarHeader.Name, tarHeader.Size)
}
var fileContent = make([]byte, tarHeader.Size)

// Not preventable by the caller; guard the parsed header before allocation:
if tarHeader.Size < 0 || tarHeader.Size > maxReadFileSize {
    return fmt.Errorf("invalid tar entry size %d for %s", tarHeader.Size, tarHeader.Name)
}

func validTarSize(h *tar.Header) bool {
    return h != nil && h.Size >= 0
}

content, err := tool.ReadFile(ctx, flowID, path)
if err != nil && strings.Contains(err.Error(), "has invalid size") {
    // treat as corruption: log and retry the whole read once
    content, err = tool.ReadFile(ctx, flowID, path)
}

When it happens

Trigger: Only reachable when tarReader.Next() yields a header whose Size < 0 — practically impossible for well-formed Docker-generated tars; indicates a corrupted stream, a bug in a wrapping reader, or tampered/interposed transport.

Common situations: Bit-flip/corruption on a remote Docker TCP connection; a custom or older Docker daemon/registry layer emitting non-standard headers; fuzzing or adversarial input tests against the file-read path.

Related errors

• failed to copy file: %w
• failed to read tar header: %w
• failed to read file '%s' content: %w
• tar archive header generation failed: %w
• tar archive content serialization failed: %w

AI-assisted analysis of vxcontrol/pentagi@ea665308ba (2026-09-01). Data as JSON: /api/errors/986c04bd6399cacc. Report an issue: GitHub.