[Bug]: Cannot download replay due to BufferUnderflowException

[lL1l1]

Describe the Bug

When I click the play or "download more information" buttons for replays #26277555, #26277324, and #26277279, I get the exception and the download fails.

Log file or Error Message

Client v2025.11.13

java.util.concurrent.CompletionException: java.nio.BufferUnderflowException
	at java.base/java.util.concurrent.CompletableFuture.wrapInCompletionException(CompletableFuture.java:323)
	at java.base/java.util.concurrent.CompletableFuture.encodeThrowable(CompletableFuture.java:359)
	at java.base/java.util.concurrent.CompletableFuture.completeThrowable(CompletableFuture.java:364)
	at java.base/java.util.concurrent.CompletableFuture$UniAccept.tryFire(CompletableFuture.java:743)
	at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:531)
	at java.base/java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:2206)
	at com.faforever.client.task.CompletableTask.lambda$new$2(CompletableTask.java:24)
	at com.sun.javafx.event.CompositeEventHandler.dispatchBubblingEvent(CompositeEventHandler.java:86)
	at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(EventHandlerManager.java:232)
	at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(EventHandlerManager.java:189)
	at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(BasicEventDispatcher.java:58)
	at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(EventDispatchChainImpl.java:114)
	at com.sun.javafx.event.EventUtil.fireEventImpl(EventUtil.java:74)
	at com.sun.javafx.event.EventUtil.fireEvent(EventUtil.java:54)
	at javafx.event.Event.fireEvent(Event.java:199)
	at javafx.concurrent.EventHelper.fireEvent(EventHelper.java:219)
	at javafx.concurrent.Task.fireEvent(Task.java:1340)
	at javafx.concurrent.Task.setState(Task.java:724)
	at javafx.concurrent.Task$TaskCallable.lambda$call$1(Task.java:1418)
	at com.sun.javafx.application.PlatformImpl.lambda$runLater$0(PlatformImpl.java:424)
	at com.sun.glass.ui.InvokeLaterDispatcher$Future.run(InvokeLaterDispatcher.java:95)
	at com.sun.glass.ui.win.WinApplication._runLoop(Native Method)
	at com.sun.glass.ui.win.WinApplication.lambda$runLoop$0(WinApplication.java:168)
	at java.base/java.lang.Thread.run(Thread.java:1474)
Caused by: java.nio.BufferUnderflowException: null
	at java.base/java.nio.Buffer.nextGetIndex(Buffer.java:720)
	at java.base/java.nio.HeapByteBuffer.getShort(HeapByteBuffer.java:450)
	at com.faforever.commons.replay.body.ReplayBodyTokenizer.tokenize(ReplayBodyTokenizer.java:22)
	at com.faforever.commons.replay.ReplayDataParser.parse(ReplayDataParser.java:449)
	at com.faforever.commons.replay.ReplayDataParser.<init>(ReplayDataParser.java:77)
	at com.faforever.client.replay.ReplayFileReaderImpl.parseReplay(ReplayFileReaderImpl.java:23)
	at com.faforever.client.replay.ReplayService.runFafReplayFile(ReplayService.java:371)
	at com.faforever.client.replay.ReplayService.runReplayFile(ReplayService.java:344)
	at com.faforever.client.replay.ReplayService.lambda$runOnlineReplay$0(ReplayService.java:353)
	at java.base/java.util.concurrent.CompletableFuture$UniAccept.tryFire(CompletableFuture.java:739)
	... 20 common frames omitted

Reproduce the bug

Attempt to play or download replays #26277555, #26277324, and #26277279.

Expected Behavior

The replays download successfully and work like most other replays.

Screenshots

No response

Additional context

No response

Which Operating System are you using?

Windows

[Rogerstalker]

I looked at a few replays and found the following:
I stopped the debugger in the ReplayBodyTokenizer.tokenize method and checked out which part causes the BufferUnderflowException.
The method in question:

    ArrayList<ReplayBodyToken> tokens = new ArrayList<>();
    final int length = buffer.limit();
    while (buffer.position() < length) {
      final int tokenId = LoadUtils.getUnsignedByte(buffer);
      final int tokenLength = buffer.getShort() - TOKEN_HEADER_LENGTH;

      buffer.position(buffer.position() + tokenLength);
      tokens.add(new ReplayBodyToken(ReplayBodyToken.TokenId.values()[tokenId], buffer.position()));
    }

    return tokens;

The following are replay examples with id number and byte index - value pairs from the buffer with buffer.get(index) & 0xFF evaluation. The last index - value pairs shown here are always the last bytes in the buffer, while the first ones are always the CMDST_END_GAME token id.
CMDST_END_GAME is 23, the next two bytes are the token length short, which is 3 in this case (keep in mind that is is a little endian binary). Meaning the CMDST_END_GAME token length is 3 - TOKEN_HEADER_LENGTH, where TOKEN_HEADER_LENGTH is 3, so zero. In cases where the tokenization fails there are two more bytes after the CMDST_END_GAME token, a 3 and a 232 value. This fails because the 3 is read as a CMDST_VERIFY_CHECKSUM token id, and the last byte and the non-existent byte after that would be interpreted as the token length.

Exception occurs
#26297723
261183 - 23
261184 - 3
261185 - 0
261186 - 3
261187 - 232

#26277555
69461 - 23
69462 - 3
69463 - 0
69464 - 3
69465 - 232

#26277324
893110 - 23
893111 - 3
893112 - 0
893113 - 3
893114 - 232

#26277279
97614 - 23
97615 - 3
97616 - 0
97617 - 3
97618 - 232

Exception does not occur
#26374668
169078 - 23
169079 - 3
169080 - 0

#26294637
712665 - 23
712666 - 3
712667 - 0

I do not know how the replay files are usually terminated, but it seems like the extra two bytes are causing the problem.