{"record":{"id":"0568558a67fec94f","repo":"peass-ng/PEASS-ng","slug":"corrupted-stream-out-of-bounds-length-found-056855","errorCode":null,"errorMessage":"corrupted stream - out of bounds length found: ","messagePattern":"corrupted stream - out of bounds length found: ","errorType":"validation","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DefiniteLengthInputStream.cs","lineNumber":101,"sourceCode":"\t\t\t// make sure it's safe to do this!\n\t\t\tint limit = Limit;\n\t\t\tif (_remaining >= limit)\n\t\t\t\tthrow new IOException(\"corrupted stream - out of bounds length found: \" + _remaining + \" >= \" + limit);\n\n\t\t\tif ((_remaining -= Streams.ReadFully(_in, buf)) != 0)\n\t\t\t\tthrow new EndOfStreamException(\"DEF length \" + _originalLength + \" object truncated by \" + _remaining);\n\t\t\tSetParentEofDetect(true);\n\t\t}\n\n\t\tinternal byte[] ToArray()\n\t\t{\n\t\t\tif (_remaining == 0)\n\t\t\t\treturn EmptyBytes;\n\n\t\t\t// make sure it's safe to do this!\n\t\t\tint limit = Limit;\n\t\t\tif (_remaining >= limit)\n\t\t\t\tthrow new IOException(\"corrupted stream - out of bounds length found: \" + _remaining + \" >= \" + limit);\n\n\t\t\tbyte[] bytes = new byte[_remaining];\n\t\t\tif ((_remaining -= Streams.ReadFully(_in, bytes)) != 0)\n\t\t\t\tthrow new EndOfStreamException(\"DEF length \" + _originalLength + \" object truncated by \" + _remaining);\n\t\t\tSetParentEofDetect(true);\n\t\t\treturn bytes;\n\t\t}\n\t}\n}\n","sourceCodeStart":83,"sourceCodeEnd":111,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DefiniteLengthInputStream.cs#L83-L111","documentation":"DefiniteLengthInputStream.ToArray validates that the declared definite length (_remaining) fits within the enclosing stream's Limit before allocating; if _remaining >= limit it throws IOException 'corrupted stream - out of bounds length found'. This guards against a DER length header claiming more bytes than the stream can contain.","triggerScenarios":"Parsing a stream whose ASN.1 object header declares a length larger than the total available data — corrupted or maliciously crafted length fields, truncated files, or a stream shorter than the encoded structure.","commonSituations":"Opening a truncated certificate/CRL/PKCS#7 file; loading files corrupted by bad transfers (FTP ASCII mode, partial downloads); parsing hostile input with oversized length fields (DoS guard).","solutions":["Verify the file is complete: compare its size against the expected encoded length","Re-download/re-export the blob; check for ASCII-mode transfers corrupting binary data","If parsing a fragment of a larger structure, pass the correct slice length to the stream","Treat as untrusted input: catch IOException and reject the data (this is an intentional anti-DoS guard)"],"exampleFix":"// before\nAsn1Object o = Asn1Object.FromStream(possiblyTruncatedStream);\n// after\nif (streamData.Length < 2) throw new InvalidDataException(\"too short for DER\");\nint declared = GetDerLength(streamData); // validate header vs data.Length first\nif (declared > streamData.Length - headerSize) throw new InvalidDataException(\"truncated DER\");\nAsn1Object o = Asn1Object.FromStream(new MemoryStream(streamData));","handlingStrategy":"validation","validationCode":"// ensure stream data length is consistent with DER header before parsing\nint ReadDerLength(byte[] d, out int headerSize) { int n = d[1] & 0x7f; headerSize = 2; if ((d[1] & 0x80) != 0) { headerSize = 2 + n; } return n; }","typeGuard":null,"tryCatchPattern":"try { return Asn1Object.FromStream(ms); }\ncatch (IOException ex) { throw new InvalidDataException(\"corrupted or truncated ASN.1 stream\", ex); }","preventionTips":["Buffer the full blob into byte[]/MemoryStream before parsing so lengths can be checked","Verify file integrity (size, checksum) after download/transfer","Use binary-safe transfer modes for DER files","Reject absurdly large declared lengths on untrusted input"],"tags":["asn1","corrupt-stream","truncated","bouncycastle"],"backgroundTag":"der-length-out-of-bounds","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}