{"record":{"id":"0c75f6691ace095b","repo":"peass-ng/PEASS-ng","slug":"malformed-bmpstring-encoding-encountered","errorCode":null,"errorMessage":"malformed BMPString encoding encountered","messagePattern":"malformed BMPString encoding encountered","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs","lineNumber":334,"sourceCode":"                return defIn.ToArray();\n            }\n\n            byte[] buf = tmpBuffers[len];\n            if (buf == null)\n            {\n                buf = tmpBuffers[len] = new byte[len];\n            }\n\n            defIn.ReadAllIntoByteArray(buf);\n\n            return buf;\n        }\n\n        private static char[] GetBmpCharBuffer(DefiniteLengthInputStream defIn)\n        {\n            int remainingBytes = defIn.Remaining;\n            if (0 != (remainingBytes & 1))\n                throw new IOException(\"malformed BMPString encoding encountered\");\n\n            char[] str = new char[remainingBytes / 2];\n            int stringPos = 0;\n\n            byte[] buf = new byte[8];\n            while (remainingBytes >= 8)\n            {\n                if (Streams.ReadFully(defIn, buf, 0, 8) != 8)\n                    throw new EndOfStreamException(\"EOF encountered in middle of BMPString\");\n\n                str[stringPos] = (char)((buf[0] << 8) | (buf[1] & 0xFF));\n                str[stringPos + 1] = (char)((buf[2] << 8) | (buf[3] & 0xFF));\n                str[stringPos + 2] = (char)((buf[4] << 8) | (buf[5] & 0xFF));\n                str[stringPos + 3] = (char)((buf[6] << 8) | (buf[7] & 0xFF));\n                stringPos += 4;\n                remainingBytes -= 8;\n            }\n            if (remainingBytes > 0)","sourceCodeStart":316,"sourceCodeEnd":352,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs#L316-L352","documentation":"GetBmpCharBuffer requires BMPString contents to be an even number of bytes, since each character is encoded as 2 bytes (UCS-2). An odd remaining byte count means the encoding is malformed, so an IOException is thrown.","triggerScenarios":"Parsing a primitive BMPString (tag 0x1E) whose definite length is odd, e.g. corrupt DER or hand-assembled bytes with a wrong length field.","commonSituations":"Corrupted certificates where the BMPString (often used in certificate subject/issuer fields) length byte was damaged; buggy encoders writing byte-count instead of char-count; manually constructed ASN.1 test data.","solutions":["Verify the DER encoding: BMPString length field must be even and match the actual byte count","Re-encode the string with a correct encoder (DerBmpString) instead of manual byte assembly","Check for bit-level corruption in the source data; re-obtain from a trusted source","Catch IOException and report the specific certificate/field as malformed"],"exampleFix":"// before\nbyte[] bad = Encoding.Unicode.GetBytes(\"CN\"); // truncated by 1 byte upstream\n// after\nAsn1Object bmp = new DerBmpString(\"CN\"); // let the library encode\nbyte[] der = bmp.GetDerEncoded();","handlingStrategy":"validation","validationCode":"static bool BmpStringLengthIsEven(byte[] der)\n{\n    // locate a primitive BMPString (tag 0x1E) and check its content length parity\n    for (int i = 0; i + 1 < der.Length; i++)\n    {\n        if (der[i] == 0x1e)\n        {\n            int lb = der[i + 1];\n            return (lb & 1) == 0;\n        }\n    }\n    return true; // no BMPString found\n}","typeGuard":null,"tryCatchPattern":"try { Asn1Object o = Asn1Object.FromByteArray(data); }\ncatch (IOException ex) when (ex.Message.Contains(\"BMPString\"))\n{\n    // malformed BMPString encoding\n}","preventionTips":["Use DerBmpString to encode instead of manual byte assembly","Remember BMPString is UCS-2: content length must be even","Re-obtain data if certificates show corruption in name fields"],"tags":["asn1","bmpstring","encoding","der"],"backgroundTag":"malformed-bmpstring","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}